* [PATCH] i2c/designware: Fix an initialization issue
@ 2025-06-26 19:05 Michael J. Ruhl
2025-06-26 19:33 ` Andy Shevchenko
0 siblings, 1 reply; 4+ messages in thread
From: Michael J. Ruhl @ 2025-06-26 19:05 UTC (permalink / raw)
To: linux-i2c, andi.shyti, andriy.shevchenko; +Cc: Michael J. Ruhl, stable
The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the
dev context to be initialized.
amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx.
This could allow an out of bounds access (of msgs).
Initialize msg_write_idx before calling i2c_dw_xfer_init().
Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU")
Cc: <stable@vger.kernel.org>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
---
drivers/i2c/busses/i2c-designware-master.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index c5394229b77f..40aa5114bf8c 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -363,6 +363,7 @@ static int amd_i2c_dw_xfer_quirk(struct i2c_adapter *adap, struct i2c_msg *msgs,
dev->msgs = msgs;
dev->msgs_num = num_msgs;
+ dev->msg_write_idx = 0;
i2c_dw_xfer_init(dev);
/* Initiate messages read/write transaction */
--
2.49.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] i2c/designware: Fix an initialization issue
2025-06-26 19:05 [PATCH] i2c/designware: Fix an initialization issue Michael J. Ruhl
@ 2025-06-26 19:33 ` Andy Shevchenko
0 siblings, 0 replies; 4+ messages in thread
From: Andy Shevchenko @ 2025-06-26 19:33 UTC (permalink / raw)
To: Michael J. Ruhl; +Cc: linux-i2c, andi.shyti, stable
On Thu, Jun 26, 2025 at 03:05:25PM -0400, Michael J. Ruhl wrote:
> The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the
> dev context to be initialized.
>
> amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx.
>
> This could allow an out of bounds access (of msgs).
>
> Initialize msg_write_idx before calling i2c_dw_xfer_init().
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] i2c/designware: Fix an initialization issue
@ 2025-06-27 14:35 Michael J. Ruhl
2025-06-30 18:03 ` Andi Shyti
0 siblings, 1 reply; 4+ messages in thread
From: Michael J. Ruhl @ 2025-06-27 14:35 UTC (permalink / raw)
To: linux-i2c, andi.shyti, andriy.shevchenko
Cc: Michael J. Ruhl, Andy Shevchenko, stable
The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the
dev context to be initialized.
amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx.
This could allow an out of bounds access (of msgs).
Initialize msg_write_idx before calling i2c_dw_xfer_init().
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU")
Cc: <stable@vger.kernel.org>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
---
drivers/i2c/busses/i2c-designware-master.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index c5394229b77f..40aa5114bf8c 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -363,6 +363,7 @@ static int amd_i2c_dw_xfer_quirk(struct i2c_adapter *adap, struct i2c_msg *msgs,
dev->msgs = msgs;
dev->msgs_num = num_msgs;
+ dev->msg_write_idx = 0;
i2c_dw_xfer_init(dev);
/* Initiate messages read/write transaction */
--
2.49.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] i2c/designware: Fix an initialization issue
2025-06-27 14:35 Michael J. Ruhl
@ 2025-06-30 18:03 ` Andi Shyti
0 siblings, 0 replies; 4+ messages in thread
From: Andi Shyti @ 2025-06-30 18:03 UTC (permalink / raw)
To: Michael J. Ruhl; +Cc: linux-i2c, andriy.shevchenko, Andy Shevchenko, stable
Hi Michael,
On Fri, Jun 27, 2025 at 10:35:11AM -0400, Michael J. Ruhl wrote:
> The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the
> dev context to be initialized.
>
> amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx.
>
> This could allow an out of bounds access (of msgs).
>
> Initialize msg_write_idx before calling i2c_dw_xfer_init().
>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
merged to i2c/i2c-host-fixes.
Thank you,
Andi
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-06-30 18:03 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-26 19:05 [PATCH] i2c/designware: Fix an initialization issue Michael J. Ruhl
2025-06-26 19:33 ` Andy Shevchenko
-- strict thread matches above, loose matches on Subject: below --
2025-06-27 14:35 Michael J. Ruhl
2025-06-30 18:03 ` Andi Shyti
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox