[PATCH v2] i2c: smbus: reject oversized block transfers in the common path

[Weiming Shi <bestswngs@gmail.com>]

The SMBus block transfer length data->block[0] is validated in
i2c_smbus_xfer_emulated() but that check runs too late for tracepoints
and is skipped entirely when the adapter provides a native smbus_xfer
implementation. This allows user-controlled oversized block lengths to
reach tracepoint memcpy calls and driver callbacks unchecked.

Add an early validation in __i2c_smbus_xfer() that rejects block
transfers with data->block[0] > I2C_SMBUS_BLOCK_MAX before any
tracepoint fires or driver callback runs. This is consistent with
the existing -EINVAL convention in the emulated path and protects all
downstream consumers at once: the smbus_write tracepoint, all native
smbus_xfer driver implementations, and the emulated path.

Two distinct bugs are fixed by this change:

Bug 1: smbus_write tracepoint OOB (include/trace/events/smbus.h)
  trace_smbus_write() fires before any validation and copies
  data->block[0]+1 bytes into a 34-byte event buffer. With
  block[0]=0xfe the tracepoint copies 255 bytes, overflowing by 221.

 BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_smbus_write+0x27c/0x530
 Read of size 255 at addr ffff88800c8b7cd8 by task poc_smbus/86
 Call Trace:
  <TASK>
  trace_event_raw_event_smbus_write+0x27c/0x530 (include/trace/events/smbus.h:23)
  __i2c_smbus_xfer+0x43a/0xa40 (include/trace/events/smbus.h:91)
  i2c_smbus_xfer+0x19e/0x340 (include/linux/i2c.h:835)
  i2cdev_ioctl_smbus+0x38f/0x7f0 (drivers/i2c/i2c-dev.c:391)
  i2cdev_ioctl+0x35e/0x680 (drivers/i2c/i2c-dev.c:478)
  __x64_sys_ioctl+0x147/0x1e0 (fs/ioctl.c:52)
  do_syscall_64+0xcf/0x15d0 (arch/x86/entry/syscall_64.c:63)
  entry_SYSCALL_64_after_hwframe+0x76/0x7e (arch/x86/entry/entry_64.S:130)
  </TASK>

Bug 2: i2c-stub I2C_SMBUS_I2C_BLOCK_DATA OOB (drivers/i2c/i2c-stub.c)
  stub_xfer() implements .smbus_xfer directly and only clamps
  block[0] against 256-command, not I2C_SMBUS_BLOCK_MAX. With
  block[0]=0xff and command=0 the loop accesses block[1+i] for
  i up to 254, far past the 34-byte union.

 UBSAN: array-index-out-of-bounds in drivers/i2c/i2c-stub.c:223:44
 index 34 is out of range for type '__u8 [34]'
 Call Trace:
  <TASK>
  stub_xfer+0x1971/0x198f [i2c_stub] (drivers/i2c/i2c-stub.c:223)
  __i2c_smbus_xfer+0x306/0xa40 (drivers/i2c/i2c-core-smbus.c:607)
  i2c_smbus_xfer+0x19e/0x340 (include/linux/i2c.h:835)
  i2cdev_ioctl_smbus+0x38f/0x7f0 (drivers/i2c/i2c-dev.c:391)
  i2cdev_ioctl+0x35e/0x680 (drivers/i2c/i2c-dev.c:478)
  __x64_sys_ioctl+0x147/0x1e0 (fs/ioctl.c:52)
  do_syscall_64+0xcf/0x15d0 (arch/x86/entry/syscall_64.c:63)
  entry_SYSCALL_64_after_hwframe+0x76/0x7e (arch/x86/entry/entry_64.S:130)
  </TASK>

Fixes: 8a325997d95d ("i2c: Add message transfer tracepoints for SMBUS [ver #2]")
Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
Changes since the initial submission:
- Moved the check from stub_xfer() into __i2c_smbus_xfer() so it
  covers all callers, not just i2c-stub. This also fixes a separate
  OOB in the smbus_write tracepoint that hits the same missing
  validation from a different angle.

 drivers/i2c/i2c-core-smbus.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
index 71eb1ef56f0c..edb093687a4c 100644
--- a/drivers/i2c/i2c-core-smbus.c
+++ b/drivers/i2c/i2c-core-smbus.c
@@ -566,6 +566,15 @@ s32 __i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr,
 	if (res)
 		return res;
 
+	/* Reject invalid block lengths before they reach tracepoints
+	 * or native smbus_xfer implementations.
+	 */
+	if (data && (protocol == I2C_SMBUS_BLOCK_DATA ||
+		     protocol == I2C_SMBUS_BLOCK_PROC_CALL ||
+		     protocol == I2C_SMBUS_I2C_BLOCK_DATA) &&
+	    data->block[0] > I2C_SMBUS_BLOCK_MAX)
+		return -EINVAL;
+
 	/* If enabled, the following two tracepoints are conditional on
 	 * read_write and protocol.
 	 */
-- 
2.43.0