Patch "HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()" has been added to the 5.18-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()

to the 5.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-mcp2221-prevent-a-buffer-overflow-in-mcp_smbus_w.patch
and it can be found in the queue-5.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f2203d000ed1915fdbdc173b2e9fd82b7bdd7170
Author: Harshit Mogalapalli <harshit.m.mogalapalli@xxxxxxxxxx>
Date:   Mon Jun 20 09:28:24 2022 -0700

    HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
    
    [ Upstream commit 62ac2473553a00229e67bdf3cb023b62cf7f5a9a ]
    
    Smatch Warning:
    drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
    '&mcp->txbuf[5]' too small (59 vs 255)
    drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
    too small (34 vs 255)
    
    The 'len' variable can take a value between 0-255 as it can come from
    data->block[0] and it is user data. So add an bound check to prevent a
    buffer overflow in memcpy().
    
    Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
    Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@xxxxxxxxxx>
    Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index 4211b9839209..de52e9f7bb8c 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -385,6 +385,9 @@ static int mcp_smbus_write(struct mcp2221 *mcp, u16 addr,
 		data_len = 7;
 		break;
 	default:
+		if (len > I2C_SMBUS_BLOCK_MAX)
+			return -EINVAL;
+
 		memcpy(&mcp->txbuf[5], buf, len);
 		data_len = len + 5;
 	}



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux