From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A372639184F for ; Wed, 5 Aug 2026 05:08:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785906539; cv=none; b=VUPutewOdqwUM8cx0hzKOMxRnWsPixz2o106hTkZIgAWQU9ra2pVh+t5S6S5xWAMVKSxqu0xQRhRy7p7ICvUEXVXikP+fSumrR1np3reE0hYppNIhzfLQi3PmZTmaCBLvA09rNzP6jpBdLKVv2kxm62IIqJ7PoNVyYnpZD47pJI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785906539; c=relaxed/simple; bh=XjGnkKbz8Rb9EuBzDyxeRzqNwncAPrVTYrZRPB8Vz2E=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=C+FuQGMiavb9sCRqT/pCYuaItD8oBJ7KKaEwyQZSrc6cD9Eo7H8d3+SfjQyTVh0ebBZ4z5Y7iM1n7R9w5Hl/9m02T+P9P3JGG7SRWdrfmz8MLTSOXyNW9IwagZZMohehEgxtQ0gCXDouL1ylRN+p/k6BAYAXX5ayxOUGOCKmjPo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qg0MoPax; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qg0MoPax" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-ca913a601fbso480703a12.3 for ; Tue, 04 Aug 2026 22:08:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785906538; x=1786511338; darn=vger.kernel.org; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=kT2AjLary7mMQwGAhHHhXdSYn8k6stuUNJfnGqWcbZY=; b=qg0MoPaxTMA0y6zfXNM6ThqxtU2+5vGP8qp0dL15p4YwQZRbQLGQNTMN9hUAQtgZmQ +OWI0IBO7MDmn4wipOlJgk9p+euv/OaIB5YBypbnVDU+9MewjIAdAbln8EbriCcPReE/ IYXfuem040qJjKy6OdE91j7i4F7tnXArZO+wpJyW28toDW/5bgnIlrYaOnLhyo5bZy/J Bq6J/dF20o82YYbVBST+L+TQ7ORX9cGLxqMtXdg93Y0oZTZ8cBJF7B+kmLPkZKq2FgAr wRQvXb6WYnq4X9dC6aROrLbZbYT+F8QuUX9lrSztHCbK4xqBPC6RxQvAq2L3d9xob9Be xdKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785906538; x=1786511338; h=content-disposition:content-type:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kT2AjLary7mMQwGAhHHhXdSYn8k6stuUNJfnGqWcbZY=; b=Pl2714r0jOBhOzcGWfiKkqUnaYRKzjQh/EiNMag+WDrqdsVRJGQAukl8nLekZA6yEc oX31x6svUWcx6Bop6w7oFnl6bnq0LDl9UHwtxEQCmleP3Mj2yPraQakcAZE9g9aHuhk2 DKMj7uvaIYw7H6NMVEbLqmxONue1jRHvoHfjZYar0RHTxOtC6Y1xz/a9Mg0fQRa+PNcf TDBB8FPBDt+58526AZ9EEjJMOcEtvNfY3JkbDwdIJ6+mjPJ0i47YiORi4Ewze9E9C6Bh acx6qvg9ysFyuxU/4L/zHuYYOnKAF4mXETiiEseiN0n6pXJ2SmxLy6eZS3GE8G7gyZUq J7vw== X-Forwarded-Encrypted: i=1; AHgh+RppVx52vhdZKMBPchxztNph1BqQKt8ko93r0OZSLZb2tFm/NwdpODjReIPcctGzqRsVG4+HvbPvfSsBwxM=@vger.kernel.org X-Gm-Message-State: AOJu0YxWp+PaVCj1VTp+gIr/h5uuHq+nHbof9ARnSIIvf1unu9XpCLua pNW+IxDS9fRFq/q8aQZPagw9iAXYxRCpIjqpsqyGOUVD9magYUSRYC82 X-Gm-Gg: AR+sD115t2f9gQjweDIk8r8aYX8uSXxdKHm15fTe5EX5qFbSh6CkTYjVlBWW1Jvv+7A I1va8SQFKMQrVMxjy9i8v0U+cpTAngE/sG9uINkETJNh1UFQ5bw/YtpguxBQpknaJrY+2XsOrWG AFxk6NyV3acE8XvR9QhtXYDs5tohiPmBIKyRG4SrlPy9gEKcMdBtVKs+JjZ/jrlfDL8FFEjVODj mK5lgMCnHmJRA36rFA4AbAcOsbeSbaGUnboLrt1cF8bUnhR6FapxACuOs1UbUc0mGuPXRMiLm7w 9nNUpaitRS2bmmBhTh64BK6bSsohAiW2QutOEo7RUD4nZtLYhOPThzQNQuxd5FiyCuFGBMnKAOj CIUDx/UP02JxCdw21qE88edUvL6VFd1LIFgFhtES2UH0aw0eMPhPtfb0FQZYedEwO2HppukhKfF S7eJWJ7dlpVP/8SVSpJMpvaRpxZQiYCfh2crCACBQrZ0gdbSVAwMYy6eqBQTf+9dRLSzGMjaP5i ImV1v5SP/KDOmx5eAei4H6Ls7Y1h1mYb2HSL8AZ X-Received: by 2002:a05:6a20:d48f:b0:3bf:d487:4b42 with SMTP id adf61e73a8af0-3cb86027257mr4815520637.35.1785906537980; Tue, 04 Aug 2026 22:08:57 -0700 (PDT) Received: from google.com ([2a00:79e0:2ebe:8:bf3a:ac93:79c4:84fd]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315863b0c54sm12695769eec.5.2026.08.04.22.08.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 22:08:57 -0700 (PDT) Date: Tue, 4 Aug 2026 22:08:54 -0700 From: Dmitry Torokhov To: linux-input@vger.kernel.org Cc: Benjamin Tissoires , Andrew Duggan , linux-kernel@vger.kernel.org Subject: [PATCH] Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total length (len) instead of the remaining length (cur_len). If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb_block_write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer. Fix this by calculating block_len using cur_len and advancing the buffer and address pointers by block_len. Fixes: 82264d0cf7aef ("Input: synaptics-rmi4 - add SMBus support") Cc: stable@vger.kernel.org Reported-by: sashiko-bot@kernel.org Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Dmitry Torokhov --- drivers/input/rmi4/rmi_smbus.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c index 6de68c602558..d799405fbd33 100644 --- a/drivers/input/rmi4/rmi_smbus.c +++ b/drivers/input/rmi4/rmi_smbus.c @@ -140,7 +140,7 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr, u8 commandcode; struct rmi_smb_xport *rmi_smb = container_of(xport, struct rmi_smb_xport, xport); - int cur_len = (int)len; + size_t cur_len = len; mutex_lock(&rmi_smb->page_mutex); @@ -148,7 +148,7 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr, /* * break into 32 bytes chunks to write get command code */ - int block_len = min_t(int, len, SMB_MAX_COUNT); + int block_len = min_t(size_t, cur_len, SMB_MAX_COUNT); retval = rmi_smb_get_command_code(xport, rmiaddr, block_len, false, &commandcode); @@ -161,9 +161,9 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr, goto exit; /* prepare to write next block of bytes */ - cur_len -= SMB_MAX_COUNT; - databuff += SMB_MAX_COUNT; - rmiaddr += SMB_MAX_COUNT; + cur_len -= block_len; + databuff += block_len; + rmiaddr += block_len; } exit: mutex_unlock(&rmi_smb->page_mutex); -- 2.55.0.571.g244d577d93-goog -- Dmitry