Dan Carpenter 24c6fc6e74 i2c: ismt: prevent memory corruption in ismt_access() ...

commit 690b2549b1 upstream.

The "data->block[0]" variable comes from the user and is a number
between 0-255.  It needs to be capped to prevent writing beyond the end
of dma_buffer[].

Fixes: 5e9a97b1f4 ("i2c: ismt: Adding support for I2C_SMBUS_BLOCK_PROC_CALL")
Reported-and-tested-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2022-06-06 08:43:37 +02:00

..

algos

…

busses

i2c: ismt: prevent memory corruption in ismt_access()

2022-06-06 08:43:37 +02:00

muxes

i2c: mux: demux-pinctrl: do not deactivate a master that is not active

2022-04-08 14:23:42 +02:00

i2c-boardinfo.c

…

i2c-core-acpi.c

i2c: acpi: fix resource leak in reconfiguration device addition

2021-10-02 08:38:43 +02:00

i2c-core-base.c

Revert "i2c: core: support bus regulator controlling in adapter"

2022-01-11 15:35:15 +01:00

i2c-core-of.c

…

i2c-core-slave.c

…

i2c-core-smbus.c

…

i2c-core.h

…

i2c-dev.c

i2c: dev: check return value when calling dev_set_name()

2022-04-20 09:34:20 +02:00

i2c-mux.c

…

i2c-slave-eeprom.c

…

i2c-slave-testunit.c

…

i2c-smbus.c

…

i2c-stub.c

…

Kconfig

…

Makefile

…