[PATCH 0/2] Input: clamp SMBus block reads to the caller's buffer

[Chengyu Liu <lui2012qwq@gmail.com>]

i2c_smbus_read_block_data() has no length parameter: it copies the
device-reported byte count (clamped to I2C_SMBUS_BLOCK_MAX by the
core) into the caller's buffer, so callers must pass a full-size
buffer.  An audit of all call sites found two input drivers passing
smaller stack buffers:

 - rmi4: rmi_read_pdt_entry() reads PDT entries into a 6-byte stack
   buffer during PDT scanning at probe time; a device reporting a
   count of 32 overruns it by 26 bytes.

 - cyapa: cyapa_gen3_irq_handler() reads into a 27-byte struct
   cyapa_reg_data on every touch interrupt; a count of 32 overruns it
   by 5 bytes, in interrupt context.

In both cases the contents are controlled by the device.  Bounce the
reads through a full-size buffer and clamp the copy to the requested
length.

Found by static analysis (audit of i2c_smbus_read_block_data()
callers).

Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
---

Chengyu Liu (2):
  Input: rmi4 - clamp SMBus block reads to the requested length
  Input: cyapa - clamp SMBus block reads to the caller's buffer

 drivers/input/mouse/cyapa_gen3.c | 14 ++++++++++++--
 drivers/input/rmi4/rmi_smbus.c   | 17 ++++++++++++++++-
 2 files changed, 28 insertions(+), 3 deletions(-)

-- 
2.25.1