Re: PMBus memory overflow

[Matt Corallo <yalbrymrb@mattcorallo.com>]

Adding security@kernel.org cause probably they should make sure this gets fixed.

On 5/5/25 9:39 PM, Guenter Roeck wrote:
> On 5/5/25 13:57, Matt Corallo wrote:
>>
>>
>> On 5/5/25 4:50 PM, Guenter Roeck wrote:
>>> On 5/5/25 13:41, Matt Corallo wrote:
>>>>
>>>>
>>>> On 4/25/25 4:16 AM, Wolfram Sang wrote:
>>>>>
>>>>>> Wolfram, what do you suggest ? Fixing the cp2112 driver is obviously necessary, but
>>>>>> I do wonder if a check such as the one above would be appropriate as well, possibly
>>>>>> even combined with a WARN_ONCE().
>>>>>
>>>>> How annoying, there was still an unchecked case left? Sorry. Yes, the
>>>>> core can have a check for a short-term solution. The long-term solution
>>>>> is to support SMBUS3.x which allows for 255 byte transfers.
>>>>
>>>> Thanks!
>>>>
>>>> Any update here? I guess we already have a patch so no use in me trying to write one. Would be 
>>>> nice to get this in a pull so it can head through backports.
>>>>
>>>
>>> Not from my side, sorry. I am deeply buried in work and don't have time for anything
>>> that isn't super-urgent :-(
>>
>> Mmm, shame, its kinda annoying to leave a buffer overflow reachable from a malicious USB device 
>> sitting around (okay, with the default hardening configs it gets caught, but still). Can we just 
>> land the above patch from Wolfram to check the length before writing the buffer? Happy to clean it 
>> up as a formal patch submission if its easier for you.
>>
> 
> Please go ahead.
> 
> Thanks,
> Guenter
>