Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2 1/2] i2c: core-smbus: fix a potential uninitialization
 bug
To:     Wolfram Sang <wsa@the-dreams.de>, Wenwen Wang <wang6495@umn.edu>
Cc:     Kangjie Lu <kjlu@umn.edu>,
        "open list:I2C SUBSYSTEM" <linux-i2c@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>
References: <1525525030-9805-1-git-send-email-wang6495@umn.edu>
 <20180510111737.b6g7s2nnf6froote@ninjato>
From:   Peter Rosin <peda@axentia.se>
Organization: Axentia Technologies AB
Message-ID: <ac843580-884e-b0fc-60af-8d73ba099100@axentia.se>
Date:   Mon, 14 May 2018 22:31:07 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.7.0
MIME-Version: 1.0
In-Reply-To: <20180510111737.b6g7s2nnf6froote@ninjato>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Received-SPF: None (protection.outlook.com: axentia.se does not designate
 permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 May 2018 20:31:12.0655 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: f5d8e7c1-e822-4d93-d18d-08d5b9d9a257
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4ee68585-03e1-4785-942a-df9c1871a234
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0202MB2774
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2018-05-10 13:17, Wolfram Sang wrote:
> On Sat, May 05, 2018 at 07:57:10AM -0500, Wenwen Wang wrote:
>> In i2c_smbus_xfer_emulated(), there are two buffers: msgbuf0 and msgbuf1,
>> which are used to save a series of messages, as mentioned in the comment.
>> According to the value of the variable 'size', msgbuf0 is initialized to
>> various values. In contrast, msgbuf1 is left uninitialized until the
>> function i2c_transfer() is invoked. However, msgbuf1 is not always
>> initialized on all possible execution paths (implementation) of
>> i2c_transfer(). Thus, it is possible that msgbuf1 may still be
>> uninitialized even after the invocation of the function i2c_transfer(),
>> especially when the return value of ic2_transfer() is not checked properly.
>> In the following execution, the uninitialized msgbuf1 will be used, such as
>> for security checks. Since uninitialized values can be random and
>> arbitrary, this will cause undefined behaviors or even check bypass. For
>> example, it is expected that if the value of 'size' is
>> I2C_SMBUS_BLOCK_PROC_CALL, the value of data->block[0] should not be larger
>> than I2C_SMBUS_BLOCK_MAX. But, at the end of i2c_smbus_xfer_emulated(), the
>> value read from msgbuf1 is assigned to data->block[0], which can
>> potentially lead to invalid block write size, as demonstrated in the error
>> message.
>>
>> This patch initializes the first byte of msgbuf1 with 0 to avoid such
>> undefined behaviors or security issues.
>>
>> Signed-off-by: Wenwen Wang <wang6495@umn.edu>
> 
> From what I can tell, this patch is not needed anymore after patch 2 is
> applied. Correct?

AFAIU, it is only needed if there are bugs elsewhere. I.e. it's for extra
protection. If all drivers implement .master_xfer correctly, msgbuf1 will
be filled in and the return value will be the number of messages (i.e. 2)
OR you get a negative return value and the msgbuf1 content will not matter.

The patch does not magically fix all possible driver bugs, so in that
sense this patch is still "needed".

Also - again AFAIU - there is no known bug that actually gets caught by
this extra check.

Cheers,
Peter