diff options
| author | Asmaa Mnebhi <asmaa@nvidia.com> | 2022-09-08 20:35:39 +0300 |
|---|---|---|
| committer | Wolfram Sang <wsa@kernel.org> | 2022-09-17 21:13:57 +0300 |
| commit | de24aceb07d426b6f1c59f33889d6a964770547b (patch) | |
| tree | c5a1ef1b4fca0e7ca6a0a89ea7c67983bfe5f534 /drivers/i2c | |
| parent | 2a5be6d1340c0fefcee8a6489cff7fd88a0d5b85 (diff) | |
| download | linux-de24aceb07d426b6f1c59f33889d6a964770547b.tar.xz | |
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
memcpy() is called in a loop while 'operation->length' upper bound
is not checked and 'data_idx' also increments.
Fixes: b5b5b32081cd206b ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com>
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Diffstat (limited to 'drivers/i2c')
| -rw-r--r-- | drivers/i2c/busses/i2c-mlxbf.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c index 612736906440..ac93c0ccf53c 100644 --- a/drivers/i2c/busses/i2c-mlxbf.c +++ b/drivers/i2c/busses/i2c-mlxbf.c @@ -738,6 +738,9 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, if (flags & MLXBF_I2C_F_WRITE) { write_en = 1; write_len += operation->length; + if (data_idx + operation->length > + MLXBF_I2C_MASTER_DATA_DESC_SIZE) + return -ENOBUFS; memcpy(data_desc + data_idx, operation->buffer, operation->length); data_idx += operation->length; |