Re: PMBus memory overflow

[Guenter Roeck <linux@roeck-us.net>]

On 5/5/25 13:57, Matt Corallo wrote:
> 
> 
> On 5/5/25 4:50 PM, Guenter Roeck wrote:
>> On 5/5/25 13:41, Matt Corallo wrote:
>>>
>>>
>>> On 4/25/25 4:16 AM, Wolfram Sang wrote:
>>>>
>>>>> Wolfram, what do you suggest ? Fixing the cp2112 driver is obviously necessary, but
>>>>> I do wonder if a check such as the one above would be appropriate as well, possibly
>>>>> even combined with a WARN_ONCE().
>>>>
>>>> How annoying, there was still an unchecked case left? Sorry. Yes, the
>>>> core can have a check for a short-term solution. The long-term solution
>>>> is to support SMBUS3.x which allows for 255 byte transfers.
>>>
>>> Thanks!
>>>
>>> Any update here? I guess we already have a patch so no use in me trying to write one. Would be nice to get this in a pull so it can head through backports.
>>>
>>
>> Not from my side, sorry. I am deeply buried in work and don't have time for anything
>> that isn't super-urgent :-(
> 
> Mmm, shame, its kinda annoying to leave a buffer overflow reachable from a malicious USB device sitting around (okay, with the default hardening configs it gets caught, but still). Can we just land the above patch from Wolfram to check the length before writing the buffer? Happy to clean it up as a formal patch submission if its easier for you.
> 

Please go ahead.

Thanks,
Guenter