Commit 57f312b9 authored by Alex Guo's avatar Alex Guo Committed by Andi Shyti
Browse files

i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer 



The data->block[0] variable comes from user. Without proper check,
the variable may be very large to cause an out-of-bounds bug.

Fix this bug by checking the value of data->block[0] first.

1. commit 39244cc7 ("i2c: ismt: Fix an out-of-bounds bug in
   ismt_access()")
2. commit 92fbb6d1 ("i2c: xgene-slimpro: Fix out-of-bounds bug in
   xgene_slimpro_i2c_xfer()")

Fixes: c366be72 ("i2c: Add driver for the RTL9300 I2C controller")
Signed-off-by: default avatarAlex Guo <alexguo1023@gmail.com>
Cc: <stable@vger.kernel.org> # v6.13+
Reviewed-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
Tested-by: default avatarChris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: default avatarWolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarAndi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-1-cd9dca0db722@narfation.org
parent d41e3275

drivers/i2c/busses/i2c-rtl9300.c

+4 −0
Original line number Diff line number Diff line
@@ -281,6 +281,10 @@ static int rtl9300_i2c_smbus_xfer(struct i2c_adapter *adap, u16 addr, unsigned s 
		ret = rtl9300_i2c_reg_addr_set(i2c, command, 1);

		if (ret)

			goto out_unlock;

		if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) {

			ret = -EINVAL;

			goto out_unlock;

		}

		ret = rtl9300_i2c_config_xfer(i2c, chan, addr, data->block[0]);

		if (ret)

			goto out_unlock;