Re: PMBus memory overflow

[Kees Cook <kees@kernel.org>]

On Sun, Mar 01, 2026 at 12:10:08PM -0500, Matt Corallo wrote:
> 
> 
> On 3/1/26 11:12 AM, Kees Cook wrote:
> > 
> > 
> > On March 1, 2026 5:46:33 AM PST, Matt Corallo <yalbrymrb@mattcorallo.com> wrote:
> > > 
> > > 
> > > On 6/9/25 9:57 AM, Matt Corallo wrote:
> > > > 
> > > > 
> > > > On 6/8/25 3:14 AM, Greg KH wrote:
> > > > > Have a pointer to that patch on lore for the maintainers involved to
> > > > > review?  Note, we are in the middle of the merge window, so no new
> > > > > changes can be added to our trees until -rc1 is out.
> > > > 
> > > > A proposed patch was posted by Guenter, and tested and confirmed that it fixes the issue by myself, at https://lore.kernel.org/linux-hwmon/284466fd-39e8-419e-8af5-41dbabb788af@roeck-us.net/ . Wolfram suggested this patch was acceptable at https://lore.kernel.org/linux-hwmon/aAtEydwUfVcE0XeA@shikoro/ but that's the last he chimed in on this issue.
> > > 
> > > Any update on getting this patch applied Wolfram? Looks like the buffer overflow is still present on at least 6.18.
> > 
> > Looking at the code, I think probably the best place to check would be in i2c_smbus_read_block_data() when it does a I2C_SMBUS_BLOCK_DATA cmd, since the callers are all already checking the returned status.
> 
> I believe that's what the above patch does?

Sorry, I mis-pasted. I meant within i2c_smbus_xfer (rather than
i2c_smbus_read_block_data). Like:


diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
index 71eb1ef56f0c..fbca606ba35a 100644
--- a/drivers/i2c/i2c-core-smbus.c
+++ b/drivers/i2c/i2c-core-smbus.c
@@ -547,6 +547,10 @@ s32 i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr,
 			       command, protocol, data);
 	i2c_unlock_bus(adapter, I2C_LOCK_SEGMENT);
 
+	if (WARN_ON_ONCE(res == 0 && command == I2C_SMBUS_BLOCK_DATA &&
+			 data->block[0] > I2C_SMBUS_BLOCK_MAX))
+		res = -E2BIG;
+
 	return res;
 }
 EXPORT_SYMBOL(i2c_smbus_xfer);

-- 
Kees Cook