diff options
| author | Alex Guo <alexguo1023@gmail.com> | 2025-08-10 20:05:13 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-28 16:34:42 +0200 |
| commit | 071e43fcba5ddd9a7813e6cc0aa10299eae41b21 (patch) | |
| tree | cf421ba91fd8b4744685d66f3f5f6ba694034b15 /rust/kernel/xarray.rs | |
| parent | d23264c257a70dbe021b43b3bc2ee16134cd2c69 (diff) | |
i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer
commit 57f312b955938fc4663f430cb57a71f2414f601b upstream.
The data->block[0] variable comes from user. Without proper check,
the variable may be very large to cause an out-of-bounds bug.
Fix this bug by checking the value of data->block[0] first.
1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
ismt_access()")
2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
xgene_slimpro_i2c_xfer()")
Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
Signed-off-by: Alex Guo <alexguo1023@gmail.com>
Cc: <stable@vger.kernel.org> # v6.13+
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-1-cd9dca0db722@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'rust/kernel/xarray.rs')
0 files changed, 0 insertions, 0 deletions