android_kernel_motorola_sm6375/drivers/i2c
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Wei Chen f8cbad984b i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
commit 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 upstream.

The data->block[0] variable comes from user and is a number between
0-255. Without proper check, the variable may be very large to cause
an out-of-bounds when performing memcpy in slimpro_i2c_blkwr.

Fix this bug by checking the value of writelen.

Fixes: f6505fbabc ("i2c: add SLIMpro I2C device driver on APM X-Gene platform")
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-05 11:16:41 +02:00
..
algos
busses i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() 2023-04-05 11:16:41 +02:00
muxes i2c: mux-gpmux: Add of_node_put() when breaking out of loop 2022-08-25 11:17:47 +02:00
i2c-boardinfo.c
i2c-core-acpi.c
i2c-core-base.c i2c: Fix a potential use after free 2022-08-25 11:17:38 +02:00
i2c-core-of.c
i2c-core-slave.c
i2c-core-smbus.c
i2c-core.h
i2c-dev.c i2c: validate user data in compat ioctl 2022-01-05 12:37:45 +01:00
i2c-mux.c
i2c-slave-eeprom.c
i2c-smbus.c
i2c-stub.c
Kconfig
Makefile