Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 21 Jun 2022 09:35:35 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Rishi Gupta <gupt21@gmail.com>
Cc:     Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>,
        Jiri Kosina <jikos@kernel.org>,
        Benjamin Tissoires <benjamin.tissoires@redhat.com>,
        Linux I2C <linux-i2c@vger.kernel.org>,
        "open list:HID CORE LAYER" <linux-input@vger.kernel.org>,
        lkml <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] HID: mcp2221: prevent a buffer overflow in
 mcp_smbus_write()
Message-ID: <20220621063534.GI1999@kadam>
References: <20220620162824.58937-1-harshit.m.mogalapalli@oracle.com>
 <CALUj-gtbja9aPo1yUdGkFNEr4nYf7nhO4X6NSK5QQSQkHex+NQ@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CALUj-gtbja9aPo1yUdGkFNEr4nYf7nhO4X6NSK5QQSQkHex+NQ@mail.gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?XHGHiOqXcBd/JQvb+1rDcYyWrp3yxh51WUPtm/jNI7LGNb9+vEdQhj5J+6CM?=
 =?us-ascii?Q?MEJXh8L/sN3E99X1Uoa2rUdGMqT3fHsc6uB6zr2qyM9uNEbBIbSSuAAj51Wg?=
 =?us-ascii?Q?aANAUWAHWmLB/M1yC3f3dj3LYkOVM/UvQ1m3toEgNfAzr/4c047NOWxl32EY?=
 =?us-ascii?Q?rswSkdJ2zsrXk5W7rTTb4F1kyTqlRApK3fERo7P2OEapl6LLpeQIOuTkoSZN?=
 =?us-ascii?Q?UuZshRdAKFBnr5/CqHDQrZ+4cYcIdqHggqHKnodlayRkCPG9fffK6uAVbDC1?=
 =?us-ascii?Q?m28M1hpQr1Vbb6AQLbHGtPpbPFnvDBo6S9wyzklvzgdFJqkPGNF7S4haaZ+4?=
 =?us-ascii?Q?R888A2n8gguliA1zknOKe2BeLakPrOFItTIdRh0ABn2HVfTAIz/WaRLM3qSO?=
 =?us-ascii?Q?RvR14xC1YudkuGWw1nc8jgO/wqkEHUKJWmynAnGWpdEcDfY45zmGtHmGiCDk?=
 =?us-ascii?Q?6V8yGStSsBKEWs+xvfClN6YT/4DM9uBg5pVdsQsV1g/zGRLMPGJsLfXlUPMm?=
 =?us-ascii?Q?xhy7oP+gjlg+E+M9usU6FGqbFKzZqfvPTECDx1RsIVNatustJBjq+H7G1+tA?=
 =?us-ascii?Q?4dbAEQwVZYFOtZkTYWjMEgu5ZBQZ46glc6F1ydGj90rQHAJofYQvfkLsMlnu?=
 =?us-ascii?Q?x3jA8WwDpCONRCiwfWgCugT5O2liU1IduDXzQ3hWsTu/e3ZyOpMuAU5ENPBM?=
 =?us-ascii?Q?Ks1tVfu70zv9zpzVtDBrf1e3YFvkNiY20x4Fi0Pko/faw/oIbx17nKeyBdCZ?=
 =?us-ascii?Q?gtta3ZiZHV6gfvUDSzRAvr7bf74UCIlUA5iRZ/tfLnxZv7t7P28/kLe4vEZ6?=
 =?us-ascii?Q?sPgA4v2oV4/sd/vaqsnoJUje6+ZMnWYQfOxi5AiGIvWF+H2u20zm+pj1wOXO?=
 =?us-ascii?Q?C/2zfCy7WfIv4xm8umImPlgA+1klwXZXd4ZpxCydfN/NmaQD9GeG6FKyUJeL?=
 =?us-ascii?Q?amHpjLmZsXpBBLxJDTgUU3R5jfZDepqbKQqYPNdsXBvyLZ/UrTfyS+sz6SvY?=
 =?us-ascii?Q?76sXfiwJtPb9UTme4jhvLF+nwGnmm2ZaIh0AxZvmNMrtrbk7i+mmc3dlUkof?=
 =?us-ascii?Q?hwuZLEzJF6omgJo4gYcwcdPWtuh6fnE/8o1qBKfjgPLD3HpopLD3qHR5NHbA?=
 =?us-ascii?Q?Qfoq2YfMBijhBf55RnEwVZW4tfsZeYRPCXOwatIYYqevZEJ4Mi0cPU9/4at9?=
 =?us-ascii?Q?AIkHjEdMqTK3rrf+96OxK+K7es+FHa4+2MrrCiVLYibP3f7yNQwklBj/8Kbt?=
 =?us-ascii?Q?z7JmRph11G2XNOwARWrvfjNmd0dTwoXbnXKPiMmUWPPX3D87u4Ezjped3spK?=
 =?us-ascii?Q?Ak5AdtaZPkuBfiZ2x+6yflx1pR+rMFIrLJBKTvrMG8czo9KDN3f/+KB/X4Af?=
 =?us-ascii?Q?jAzmbd/dqqRsekwXyGEkZhNeclvv4UMlXvzJxUxWayOWQDoy+7krupHust6K?=
 =?us-ascii?Q?9m2Yx9k6nVQu3RDnh1WVGiflv4pKAXq+Y6huLp8zOFbm/Y5C6d5tz2X2rNrX?=
 =?us-ascii?Q?SQymyM7A+SnwPuwI4hENaJPixPiamy7rm1jLWJo3/AfuOL74r2jAlsiFVo6V?=
 =?us-ascii?Q?wrX7WZQEfSM7chaeXZqyodoE3DQbC3hWjPt/boZEielaFmnTOpWCXzdlv9yE?=
 =?us-ascii?Q?hyQPVaJx19s5Pq8WwkB2o9CIGy8uUm29TG44Jh5Nt/QdnHFtVx4CQr3VQ3/U?=
 =?us-ascii?Q?QpcCuYyX+aYMC9i7aTwUPN+edK6x4xEjoZAHwOZwU+EiQkPJpg1Y9vUCwczo?=
 =?us-ascii?Q?pCDJ225yCgUhmGJs5Ru3tZw7qAFEGF8=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 94e97054-3187-4dd3-1150-08da53504eb9
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jun 2022 06:36:01.8336
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: YBuHYawUI8IFViAYH9uZAd2ujNDKd1KExU8T11A8heRqcEUA5JRu2UQEasYf2h8rUsqC//qi1rMKG62qGHsj+tUuh9x8kHliO6ZNdo5M3TM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB4743
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-06-21_02:2022-06-17,2022-06-21 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 malwarescore=0
 mlxlogscore=999 bulkscore=0 phishscore=0 suspectscore=0 spamscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2206210027
X-Proofpoint-ORIG-GUID: gCxb-0m4bBdc2xsbiOg4U54sQaxsw-2c
X-Proofpoint-GUID: gCxb-0m4bBdc2xsbiOg4U54sQaxsw-2c
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Jun 20, 2022 at 11:58:27AM -0700, Rishi Gupta wrote:
> Hi Harshit,
> 
> Can you check the datasheet for correct buffer sizes please. Then
> accordingly we will decide next step.
> 

No, we don't have access to the data sheets.  This is the exact same
bug as the following patches:

381583845d19 ("HID: cp2112: prevent a buffer overflow in cp2112_xfer()")
690b2549b195 ("i2c: ismt: prevent memory corruption in ismt_access()")

The patch should fix the memory corruption but there may be other issues
with this code.

regards,
dan carpenter