Re: [PATCH 1/1] hid: fix I2C read buffer overflow in raw_event() for mcp2221

[Greg KH <greg@kroah.com>]

On Tue, Oct 07, 2025 at 03:08:11PM +0200, Romain Sioen wrote:
> From: Arnaud Lecomte <contact@arnaud-lcm.com>
> 
> [ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
> 
> As reported by syzbot, mcp2221_raw_event lacked
> validation of incoming I2C read data sizes, risking buffer
> overflows in mcp->rxbuf during multi-part transfers.
> As highlighted in the DS20005565B spec, p44, we have:
> "The number of read-back data bytes to follow in this packet:
> from 0 to a maximum of 60 bytes of read-back bytes."
> This patch enforces we don't exceed this limit.
> 
> Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346
> Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
> Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
> Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag]

I don't see a fixes tag :(

And is this only for 6.12 and 6.16?

thanks,

greg k-h