From 3d481771599cef3056386186662f02f000dabe1c Mon Sep 17 00:00:00 2001 From: Alex Guo Date: Sun, 15 Jun 2025 19:49:19 -0400 Subject: [PATCH] i2c: busses: Fix out-of-bounds bug in mchp_corei2c_smbus_xfer The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug. Fix this bug by checking the value of data->block[0] first. Similar commit: 1. commit 39244cc7548 ("i2c: ismt: Fix an out-of-bounds bug in ismt_access()") 2. commit 92fbb6d1296 ("i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()") Signed-off-by: Alex Guo Signed-off-by: Linux RISC-V bot --- drivers/i2c/busses/i2c-microchip-corei2c.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/i2c/busses/i2c-microchip-corei2c.c b/drivers/i2c/busses/i2c-microchip-corei2c.c index 492bf4c34722c2..a79d4d327f20bb 100644 --- a/drivers/i2c/busses/i2c-microchip-corei2c.c +++ b/drivers/i2c/busses/i2c-microchip-corei2c.c @@ -492,6 +492,8 @@ static int mchp_corei2c_smbus_xfer(struct i2c_adapter *adap, u16 addr, unsigned if (read_write == I2C_SMBUS_WRITE) { int data_len; + if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) + return -EINVAL; data_len = data->block[0]; msgs[CORE_I2C_SMBUS_MSG_WR].len = data_len + 2; for (int i = 0; i <= data_len; i++)