Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 21 Jul 2022 11:55:23 +0200 (CEST)
From:   Jiri Kosina <jikos@kernel.org>
To:     Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
cc:     dan.carpenter@oracle.com, Rishi Gupta <gupt21@gmail.com>,
        Benjamin Tissoires <benjamin.tissoires@redhat.com>,
        linux-i2c@vger.kernel.org, linux-input@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] HID: mcp2221: prevent a buffer overflow in
 mcp_smbus_write()
In-Reply-To: <20220620162824.58937-1-harshit.m.mogalapalli@oracle.com>
Message-ID: <nycvar.YFH.7.76.2207211154580.19850@cbobk.fhfr.pm>
References: <20220620162824.58937-1-harshit.m.mogalapalli@oracle.com>
User-Agent: Alpine 2.21 (LSU 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Mon, 20 Jun 2022, Harshit Mogalapalli wrote:

> Smatch Warning:
> drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
> '&mcp->txbuf[5]' too small (59 vs 255)
> drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
> too small (34 vs 255)
> 
> The 'len' variable can take a value between 0-255 as it can come from
> data->block[0] and it is user data. So add an bound check to prevent a
> buffer overflow in memcpy().
> 
> Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs