[PATCH RESEND] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

[PATCH RESEND] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

[Christian Marangi]

When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
stack data is copied and written to REG_SM0D1_REG. Equally on the read
part, an unnecessary read is done.

Guard these extra copy/write and read for the page_len to fix leaking
uninitialized stack memory.

Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
---
 drivers/i2c/busses/i2c-mt7621.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/i2c/busses/i2c-mt7621.c b/drivers/i2c/busses/i2c-mt7621.c
index 0a288c998419..9ea5e3f9a763 100644
--- a/drivers/i2c/busses/i2c-mt7621.c
+++ b/drivers/i2c/busses/i2c-mt7621.c
@@ -144,7 +144,6 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 	u16 addr;
 	int i, j, ret, len, page_len;
 	u32 cmd;
-	u32 data[2];
 
 	i2c = i2c_get_adapdata(adap);
 
@@ -186,6 +185,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 
 		/* transfer data */
 		for (len = pmsg->len, j = 0; len > 0; len -= 8, j += 8) {
+			u32 data[2] = { };
+
 			page_len = (len >= 8) ? 8 : len;
 
 			if (pmsg->flags & I2C_M_RD) {
@@ -194,7 +195,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 			} else {
 				memcpy(data, &pmsg->buf[j], page_len);
 				iowrite32(data[0], i2c->base + REG_SM0D0_REG);
-				iowrite32(data[1], i2c->base + REG_SM0D1_REG);
+				if (page_len > 4)
+					iowrite32(data[1], i2c->base + REG_SM0D1_REG);
 				cmd = SM0CTL1_WRITE;
 			}
 
@@ -204,7 +206,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 
 			if (pmsg->flags & I2C_M_RD) {
 				data[0] = ioread32(i2c->base + REG_SM0D0_REG);
-				data[1] = ioread32(i2c->base + REG_SM0D1_REG);
+				if (page_len > 4)
+					data[1] = ioread32(i2c->base + REG_SM0D1_REG);
 				memcpy(&pmsg->buf[j], data, page_len);
 			} else {
 				if (!(pmsg->flags & I2C_M_IGNORE_NAK)) {
-- 
2.55.0

Re: [PATCH RESEND] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

[Andi Shyti]

Hi Christian,

On Thu, Oct 22, 2026 at 09:38:51PM +0200, Christian Marangi wrote:
> When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
> stack data is copied and written to REG_SM0D1_REG. Equally on the read
> part, an unnecessary read is done.
> 
> Guard these extra copy/write and read for the page_len to fix leaking
> uninitialized stack memory.
> 
> Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>

pushed to i2c/i2c.

Thanks,
Andi

Re: [PATCH RESEND] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

[Andi Shyti]

On Thu, Oct 22, 2026 at 09:38:51PM +0200, Christian Marangi wrote:
> When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
> stack data is copied and written to REG_SM0D1_REG. Equally on the read
> part, an unnecessary read is done.
> 
> Guard these extra copy/write and read for the page_len to fix leaking
> uninitialized stack memory.
> 
> Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
> ---

BTW, this is not a RESEND, this is a V2 because the patch is
completely different from the supposed first send.

Next time, please version it properly and add the changelog.

Andi

Re: [PATCH RESEND] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

[Christian Marangi (Ansuel)]

Il giorno lun 26 ott 2026 alle ore 23:59 Andi Shyti
<andi.shyti@kernel.org> ha scritto:
>
> On Thu, Oct 22, 2026 at 09:38:51PM +0200, Christian Marangi wrote:
> > When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
> > stack data is copied and written to REG_SM0D1_REG. Equally on the read
> > part, an unnecessary read is done.
> >
> > Guard these extra copy/write and read for the page_len to fix leaking
> > uninitialized stack memory.
> >
> > Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
> > Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
> > ---
>
> BTW, this is not a RESEND, this is a V2 because the patch is
> completely different from the supposed first send.
>
> Next time, please version it properly and add the changelog.
>

I used the RESEND tag for this as the first submission was
completely wrong and didn't reflect the actual changes.

(file got mixed on saving and committing)

Had to be more clear and maybe just say ignore the previous patch?
(a v2 implied that i made changes to that patch but there weren't)

Anyway corner case... sorry won't happen again :(