diff options
| author | Asmaa Mnebhi <asmaa@nvidia.com> | 2022-09-08 19:35:39 +0200 |
|---|---|---|
| committer | Wolfram Sang <wsa@kernel.org> | 2022-09-17 20:13:57 +0200 |
| commit | de24aceb07d426b6f1c59f33889d6a964770547b (patch) | |
| tree | c5a1ef1b4fca0e7ca6a0a89ea7c67983bfe5f534 /drivers/i2c | |
| parent | i2c: mlxbf: incorrect base address passed during io write (diff) | |
| download | linux-de24aceb07d426b6f1c59f33889d6a964770547b.tar.xz linux-de24aceb07d426b6f1c59f33889d6a964770547b.zip | |
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
memcpy() is called in a loop while 'operation->length' upper bound
is not checked and 'data_idx' also increments.
Fixes: b5b5b32081cd206b ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com>
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Diffstat (limited to 'drivers/i2c')
| -rw-r--r-- | drivers/i2c/busses/i2c-mlxbf.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c index 612736906440..ac93c0ccf53c 100644 --- a/drivers/i2c/busses/i2c-mlxbf.c +++ b/drivers/i2c/busses/i2c-mlxbf.c @@ -738,6 +738,9 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, if (flags & MLXBF_I2C_F_WRITE) { write_en = 1; write_len += operation->length; + if (data_idx + operation->length > + MLXBF_I2C_MASTER_DATA_DESC_SIZE) + return -ENOBUFS; memcpy(data_desc + data_idx, operation->buffer, operation->length); data_idx += operation->length; |