Re: [PATCH] i2c: i801: Fix kernel stack buffer overflow in i801_block_transaction_byte_by_byte

[Jean Delvare <jdelvare@suse.de>]

Hi Wang,

On Mon, 11 May 2026 23:00:05 +0800, w15303746062@163.com wrote:
> A kernel stack buffer overflow exists in the
> i801_block_transaction_byte_by_byte() function due to a missing bounds
> check on the user-provided block length.
> 
> When userspace executes an ioctl(I2C_SMBUS) with the
> I2C_SMBUS_I2C_BLOCK_DATA command, the user data is copied into a local
> stack variable `union i2c_smbus_data temp` (which is approximately 34
> bytes) in i2cdev_ioctl_smbus(). This data is then passed unmodified

Approximately, really?

> through i2c_smbus_xfer() and i801_access() directly into
> i801_block_transaction_byte_by_byte().

This is incorrect. i801_block_transaction_byte_by_byte() is not called
directly by i801_access(). i2c_access() calls either
i801_smbus_block_transaction() or i801_i2c_block_transaction(), which
in turn call i801_block_transaction_byte_by_byte().

This is important because both i801_smbus_block_transaction() and
i801_i2c_block_transaction() already check the value of data->block[0]
and reject invalid values.

Therefore the stack buffer overflow you intend to fix, can't happen in
the first place.

Out of curiosity, what amount of AI was involved in the discovery of
this "bug" and in the creation of this patch?

-- 
Jean Delvare
SUSE L3 Support