From: Wolfram Sang <wsa@kernel.org>
To: Guenter Roeck <linux@roeck-us.net>
Cc: Zheyu Ma <zheyuma97@gmail.com>,
Seth Heasley <seth.heasley@intel.com>,
Neil Horman <nhorman@tuxdriver.com>,
Jean Delvare <khali@linux-fr.org>,
Bill Brown <bill.e.brown@intel.com>,
Wolfram Sang <wolfram@the-dreams.de>,
linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] i2c: ismt: Fix an out-of-bounds bug in ismt_access()
Date: Thu, 8 Sep 2022 23:11:24 +0200 [thread overview]
Message-ID: <YxpafCXQ0pwbuQ/K@kunai> (raw)
In-Reply-To: <20220908172254.GA2865640@roeck-us.net>
[-- Attachment #1: Type: text/plain, Size: 1480 bytes --]
On Thu, Sep 08, 2022 at 10:22:54AM -0700, Guenter Roeck wrote:
> On Fri, Jul 29, 2022 at 07:02:16PM +0800, Zheyu Ma wrote:
> > When the driver does not check the data from the user, the variable
> > 'data->block[0]' may be very large to cause an out-of-bounds bug.
> >
> > The following log can reveal it:
> >
> > [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20
> > [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE
> > [ 33.996475] ==================================================================
> > [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b
> > [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485
> > [ 33.999450] Call Trace:
> > [ 34.001849] memcpy+0x20/0x60
> > [ 34.002077] ismt_access.cold+0x374/0x214b
> > [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0
> > [ 34.004007] i2c_smbus_xfer+0x10a/0x390
> > [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710
> > [ 34.005196] i2cdev_ioctl+0x5ec/0x74c
> >
> > Fix this bug by checking the size of 'data->block[0]' first.
> >
> > Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller")
> > Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
>
> This patch has not been applied, and I don't see a response to it either.
> Is there a problem with it, or did it get lost ?
Seth is currently looking for a co-maintainer to assist him with this
driver.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2022-09-08 21:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-29 11:02 [PATCH] i2c: ismt: Fix an out-of-bounds bug in ismt_access() Zheyu Ma
2022-09-08 17:22 ` Guenter Roeck
2022-09-08 21:11 ` Wolfram Sang [this message]
2022-12-07 20:27 ` Wolfram Sang
-- strict thread matches above, loose matches on Subject: below --
2022-07-29 9:34 Zheyu Ma
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YxpafCXQ0pwbuQ/K@kunai \
--to=wsa@kernel.org \
--cc=bill.e.brown@intel.com \
--cc=khali@linux-fr.org \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=nhorman@tuxdriver.com \
--cc=seth.heasley@intel.com \
--cc=wolfram@the-dreams.de \
--cc=zheyuma97@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.