Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 8 Sep 2022 23:11:24 +0200
From:   Wolfram Sang <wsa@kernel.org>
To:     Guenter Roeck <linux@roeck-us.net>
Cc:     Zheyu Ma <zheyuma97@gmail.com>,
        Seth Heasley <seth.heasley@intel.com>,
        Neil Horman <nhorman@tuxdriver.com>,
        Jean Delvare <khali@linux-fr.org>,
        Bill Brown <bill.e.brown@intel.com>,
        Wolfram Sang <wolfram@the-dreams.de>,
        linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] i2c: ismt: Fix an out-of-bounds bug in ismt_access()
Message-ID: <YxpafCXQ0pwbuQ/K@kunai>
Mail-Followup-To: Wolfram Sang <wsa@kernel.org>,
        Guenter Roeck <linux@roeck-us.net>, Zheyu Ma <zheyuma97@gmail.com>,
        Seth Heasley <seth.heasley@intel.com>,
        Neil Horman <nhorman@tuxdriver.com>,
        Jean Delvare <khali@linux-fr.org>,
        Bill Brown <bill.e.brown@intel.com>,
        Wolfram Sang <wolfram@the-dreams.de>, linux-i2c@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20220729110216.557010-1-zheyuma97@gmail.com>
 <20220908172254.GA2865640@roeck-us.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="3xBGgiMuZ91XTRsz"
Content-Disposition: inline
In-Reply-To: <20220908172254.GA2865640@roeck-us.net>
Precedence: bulk


--3xBGgiMuZ91XTRsz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 08, 2022 at 10:22:54AM -0700, Guenter Roeck wrote:
> On Fri, Jul 29, 2022 at 07:02:16PM +0800, Zheyu Ma wrote:
> > When the driver does not check the data from the user, the variable
> > 'data->block[0]' may be very large to cause an out-of-bounds bug.
> >=20
> > The following log can reveal it:
> >=20
> > [   33.995542] i2c i2c-1: ioctl, cmd=3D0x720, arg=3D0x7ffcb3dc3a20
> > [   33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA:  WRITE
> > [   33.996475] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> > [   33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x21=
4b
> > [   33.997473] Read of size 18446744073709551615 at addr ffff88810efcfd=
b1 by task ismt_poc/485
> > [   33.999450] Call Trace:
> > [   34.001849]  memcpy+0x20/0x60
> > [   34.002077]  ismt_access.cold+0x374/0x214b
> > [   34.003382]  __i2c_smbus_xfer+0x44f/0xfb0
> > [   34.004007]  i2c_smbus_xfer+0x10a/0x390
> > [   34.004291]  i2cdev_ioctl_smbus+0x2c8/0x710
> > [   34.005196]  i2cdev_ioctl+0x5ec/0x74c
> >=20
> > Fix this bug by checking the size of 'data->block[0]' first.
> >=20
> > Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host=
 controller")
> > Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
>=20
> This patch has not been applied, and I don't see a response to it either.
> Is there a problem with it, or did it get lost ?

Seth is currently looking for a co-maintainer to assist him with this
driver.


--3xBGgiMuZ91XTRsz
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmMaWnMACgkQFA3kzBSg
Kbahuw/+Lv67vye8HcZXX2PovZQj+xxJgFU4ru5vG6sqjcfKmditbVOA+lh24FVK
fTQ0ueQe2Eknm7FbAdMH9+Cz7lkb6JB0lZgKZDO4dD+SDjn9jVChBOyvWkWSe+DR
sLQFuqeP7fmsg0AjD+f6rP0/oPtHwZOCEQT4s048k1ggWoHe2M8muLDqkfZN9I0U
rOMRyw60eiiOM9iamEPnKsAr/mPFY3233Jj53hesa5I2wHN4nX/eh8F6XtI7iuZg
V/JFGAojgSPjAE4MG8w06R77Go8ZwmKoYL1sTOUOjpo3SFyfnmOjS++ttoY2bOYV
XXPgpuwAflfzgaVvoWHhRSTdBY2lt7FgXtzYO6rHWkeE/l3i558BuOGloUvZVgtB
SmOajCqxKVmxankQVqeQMYD3KweIR5sfw1KE/qKmtSSCPPeczCQzc4wHIEJj60lC
VgoBDtzayEX7siMKiAGQDt0hPretcOb1cD3ECEgIPpOocad8ik1/YhyDG097Wg3w
iE/hcO6VGElfGsEP9Dm2QYxFu497JPwwbH+PTThcIXEgTJc5F2EvdClAExP4c/bQ
craLLlUa470kaRojnTZfoYOd1x4W0z86+9YMQL7wCaGrqTDdlEg+LhwrpD/b+GcI
OUIEVm2D46j+kN6OmZNXnsalleN0rFL5BLLDs3M1mV/uUky0YZs=
=6E9Q
-----END PGP SIGNATURE-----

--3xBGgiMuZ91XTRsz--