Re: PMBus memory overflow

Guenter Roeck
2026-03-02T05:19:40Z

On 3/1/26 21:09, Kees Cook wrote:
> On Sun, Mar 01, 2026 at 12:10:08PM -0500, Matt Corallo wrote:
>>
>>
>> On 3/1/26 11:12 AM, Kees Cook wrote:
>>>
>>>
>>> On March 1, 2026 5:46:33 AM PST, Matt Corallo <yalbrymrb@mattcorallo.com> wrote:
>>>>
>>>>
>>>> On 6/9/25 9:57 AM, Matt Corallo wrote:
>>>>>
>>>>>
>>>>> On 6/8/25 3:14 AM, Greg KH wrote:
>>>>>> Have a pointer to that patch on lore for the maintainers involved to
>>>>>> review?  Note, we are in the middle of the merge window, so no new
>>>>>> changes can be added to our trees until -rc1 is out.
>>>>>
>>>>> A proposed patch was posted by Guenter, and tested and confirmed that it fixes the issue by myself, at https://lore.kernel.org/linux-hwmon/284466fd-39e8-419e-8af5-41dbabb788af@roeck-us.net/ . Wolfram suggested this patch was acceptable at https://lore.kernel.org/linux-hwmon/aAtEydwUfVcE0XeA@shikoro/ but that's the last he chimed in on this issue.
>>>>
>>>> Any update on getting this patch applied Wolfram? Looks like the buffer overflow is still present on at least 6.18.
>>>
>>> Looking at the code, I think probably the best place to check would be in i2c_smbus_read_block_data() when it does a I2C_SMBUS_BLOCK_DATA cmd, since the callers are all already checking the returned status.
>>
>> I believe that's what the above patch does?
>
> Sorry, I mis-pasted. I meant within i2c_smbus_xfer (rather than
> i2c_smbus_read_block_data). Like:
>
>
> diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
> index 71eb1ef56f0c..fbca606ba35a 100644
> --- a/drivers/i2c/i2c-core-smbus.c
> +++ b/drivers/i2c/i2c-core-smbus.c
> @@ -547,6 +547,10 @@ s32 i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr,
> command, protocol, data);
> i2c_unlock_bus(adapter, I2C_LOCK_SEGMENT);
>
> + if (WARN_ON_ONCE(res == 0 && command == I2C_SMBUS_BLOCK_DATA &&
> + data->block[0] > I2C_SMBUS_BLOCK_MAX))
> + res = -E2BIG;
> +
> return res;
> }
> EXPORT_SYMBOL(i2c_smbus_xfer);
>

Agreed, that makes more sense since it covers all callers, not just
i2c_smbus_read_block_data().

Guenter