Commit 4afca954 authored by Abdurrahman Hussain's avatar Abdurrahman Hussain Committed by Guenter Roeck
Browse files

hwmon: (pmbus/adm1266) reject implausible blackbox record_count 



adm1266_nvmem_read_blackbox() loops over a record_count that comes
straight from byte 3 of the BLACKBOX_INFO response.  The destination
buffer is data->dev_mem, sized for the nvmem cell's declared 2048
bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64).
A device that reports a record_count greater than 32 -- whether due
to firmware bugs, bus corruption, or a non-responsive slave returning
0xff -- would walk read_buff past the end of the dev_mem allocation
on the trailing iterations.

Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here)
before entering the loop and return -EIO on any larger value, so a
malformed BLACKBOX_INFO response cannot drive the loop out of bounds.

Fixes: 15609d18 ("hwmon: (pmbus/adm1266) read blackbox")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAbdurrahman Hussain <abdurrahman@nexthop.ai>
Link: https://lore.kernel.org/r/20260515-adm1266-fixes-v1-3-1c1ea1349cfe@nexthop.ai


Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
parent eee213da

drivers/hwmon/pmbus/adm1266.c

+3 −0
Original line number Diff line number Diff line
@@ -46,6 +46,7 @@ 


#define ADM1266_BLACKBOX_OFFSET		0

#define ADM1266_BLACKBOX_SIZE		64

#define ADM1266_BLACKBOX_MAX_RECORDS	32



#define ADM1266_PMBUS_BLOCK_MAX		255
@@ -360,6 +361,8 @@ static int adm1266_nvmem_read_blackbox(struct adm1266_data *data, u8 *read_buff) 
		return -EIO;



	record_count = buf[3];

	if (record_count > ADM1266_BLACKBOX_MAX_RECORDS)

		return -EIO;



	for (index = 0; index < record_count; index++) {

		ret = adm1266_pmbus_block_xfer(data, ADM1266_READ_BLACKBOX, 1, &index, read_buff);