Re: PMBus memory overflow

[Kees Cook <kees@kernel.org>]

On March 1, 2026 5:46:33 AM PST, Matt Corallo <yalbrymrb@mattcorallo.com> wrote:
>
>
>On 6/9/25 9:57 AM, Matt Corallo wrote:
>> 
>> 
>> On 6/8/25 3:14 AM, Greg KH wrote:
>>> On Sat, Jun 07, 2025 at 09:25:44AM -0400, Matt Corallo wrote:
>>>> 
>>>> 
>>>> On 6/7/25 4:19 AM, Greg KH wrote:
>>>>> On Fri, Jun 06, 2025 at 04:57:37PM -0400, Matt Corallo wrote:
>>>>>> Adding security@kernel.org cause probably they should make sure this gets fixed.
>>>>> 
>>>>> That's not how security@k.o works, sorry.  As this is already public, no
>>>>> need for security@k.o to get involved at all, the normal development
>>>>> process happens here now.
>>>>> 
>>>>> So, submit a patch and people will be glad to review it!
>>>> 
>>>> Thanks, figured I'd ask. Sadly there is a patch that folks seem to be okay
>>>> with to fix a buffer overflow but its just sitting.
>>> 
>>> Have a pointer to that patch on lore for the maintainers involved to
>>> review?  Note, we are in the middle of the merge window, so no new
>>> changes can be added to our trees until -rc1 is out.
>> 
>> A proposed patch was posted by Guenter, and tested and confirmed that it fixes the issue by myself, at https://lore.kernel.org/linux-hwmon/284466fd-39e8-419e-8af5-41dbabb788af@roeck-us.net/ . Wolfram suggested this patch was acceptable at https://lore.kernel.org/linux-hwmon/aAtEydwUfVcE0XeA@shikoro/ but that's the last he chimed in on this issue.
>
>Any update on getting this patch applied Wolfram? Looks like the buffer overflow is still present on at least 6.18.

Looking at the code, I think probably the best place to check would be in i2c_smbus_read_block_data() when it does a I2C_SMBUS_BLOCK_DATA cmd, since the callers are all already checking the returned status.

-- 
Kees Cook