From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77B72474241 for ; Tue, 18 Aug 2026 12:48:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787057284; cv=none; b=FGH6w2URBkYt8UVpF1mCExJnnOjhqjPOomh56JeT+L8kCGveU20RdDOnpSvBNDlgRUdRzV3skIxDQGIzaVqnzCScqRaYrB1p9T1i0Q2KV/shKeLGG2F83lCSRNJncW4FW+anm/gWIAYRDXzByidzC5I+8YXAJ3S0NVYwKgqg6gA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787057284; c=relaxed/simple; bh=A6wW0ZUu2F786I5qd4l5k3Jghmxrfs2uEICSKwWPqmE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sLzoY6ukwdkU9PeYrus3CULJznvQjs+ORu6QQgojyDw2y45irRVkCSA/JjZRYRi3AO96ANhgEffEpbekgQHSDDRLMYD4tdhTE7wY+qjTjn8k1WMAMKZP6x7x8G/Hb6NfwHBiVYfDPDsaWES43j7V/owyy3MzLm2DZN/5xsZ+dLc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OSy8Aper; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OSy8Aper" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2d5335cf904so33159335ad.2 for ; Tue, 18 Aug 2026 05:48:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787057279; x=1787662079; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Dlh7Y8qVGJ8WIGHUnigalQWKQ2jUi5iYeCv0CSAEtt8=; b=OSy8AperA9oGV6ov1ohMxewqu3Fkmpatvp7e8lCuY/lqlJrmPkAzgzeICKL2iPSLL4 78pZ09E+U48NnwULG7yPLfNgnhG/YA4TJNqUau1Pi13o6mr4zGysFpXJhp/LdAN0CY5B GikYVFrW6+mLxPSZjsyty1NG1nkrBWHCAAmXzDl9mjJskDlUixd61mM64FZKZy3PSp9V exSFv/NPpgV5m9+jbyOAdthoOWx+HYzX6drbh47VV5CgfYEjgPTdLSjSOJk1yWmqHJuy xHijKxZ8ExZW3aCaC/JD5btuGsE2Cd8OILqnZfyOjsZOxJV8Ej8/UzjtDfWs2pj2gwan Z0tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787057279; x=1787662079; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Dlh7Y8qVGJ8WIGHUnigalQWKQ2jUi5iYeCv0CSAEtt8=; b=dc17McOL3rXTTsEbFmasPq1h9ql3b7ue0/yQTfc0ZqDFoJ0/5aFj2WTKi2Zsn2XH/3 rSIWRCqZIP1B1acYrel+0CoRr5ok5+TIFnKA50+866gNN3NE5/s+5v6z+4rOGF1FsJjc BCsneLcSCvyJ2m+nqN6ZZv98XVsPSPYJDRweBSqxbVbjN8wN5D5HyMTX76z6gbjbSJsJ 8SwZSJmXdoxoHgfT/jJCeRQTivZVRUxlzsiGDAF4EFaE+3mpBh9smAQ4sDuct2nIYoUV mc6EL3tTu2FfLcyJwBF/5F0bPRTAIzDV7F1K8QWBbwuWRqSpgtmthGWi50nfz9yWei6p UDlQ== X-Forwarded-Encrypted: i=1; AHgh+RoBAfTtL5jc9K5BtU3SI5xvXIh4OSsB6XoUyu46IRSqX6n3bNU75fluEJcaC0hi+ToUn2kM2VL2TSx+0Lw=@vger.kernel.org X-Gm-Message-State: AOJu0YxWAkOtTTP7C95bjoi+G605t84sIkh7f1Op4NxHg02llU26acmH j/Puo9F2c8ppClQdjA75jTB0OZ1v4uP77b6w3rzKDZyBMVhs9t4v6AAZd/y+76LzNA== X-Gm-Gg: AR+sD13HKqjELhz6kPZqZ6oA/PwtY2pzNPeGZIuvdnTkenvJFN4xBpDtwjC+iXMIGJn G/mKf47qRtbKo1dNDLa1KvNagsUoda1eeF6ifvBGBsJJ8uRTRLn7NshVpzFEyysLU60kqRsByy5 jtYolMWC00sHBHUcuFNKxLuRteM4IYURQdJNNYU6T1Curo/3TijXqdrW+//lRT+1umwbJLbXqZ2 jum4ZL9Dy244nlphj03+7aIB/Pf6LJXmNdi6GL4VBmd4fqkuORF3jZg5B1RyGVjlDWGm2YgnaP/ f2onwGGP9aI8STf0dRSVVsEGlJzU1lqTNQ6ch4XWPLU4f4ZFrk1VLlriKUucIRSAmn37Vh8O9b7 2mAqQF6efqXV6FJHQjP68PTWlgQP/0fTtnjnjKhf2K+NKo/++URhE+4rBoNzPi8jx9hkCBZKv2T cGscFQbGBnzHbk9qDrTg0hAB/D5bUj3lALzS2Mz/lLHy9V0f6EuqVAjBr8BOxKJxbYVnn5h3TWz 4atn0XkuyTuafJG2H3bF9b6WzS2+lnia2spKpo0ZVdRWvl4CnycmpqpLhWjSc4UkGgk X-Received: by 2002:a17:90b:4fce:b0:37c:6910:5758 with SMTP id 98e67ed59e1d1-3955a3dd55fmr12225088a91.1.1787057279493; Tue, 18 Aug 2026 05:47:59 -0700 (PDT) Received: from codespaces-2db70c.ktkhmpmw22vebpok31ngjx2qsb.ix.internal.cloudapp.net ([23.97.62.119]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-395320229f4sm8266238a91.15.2026.08.18.05.47.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 05:47:59 -0700 (PDT) From: Triet Hoang To: linux-i2c@vger.kernel.org Cc: bence98@sch.bme.hu, andi.shyti@kernel.org, linux-kernel@vger.kernel.org, Triet Hoang Subject: [PATCH] i2c: cp2615: Validate read length before copying Date: Tue, 18 Aug 2026 12:47:37 +0000 Message-ID: <20260818124737.64478-1-triet.hoang.dev@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The read_len field comes from the untrusted USB payload, which could potentially exceed the client's originally requested buffer length or MAX_I2C_SIZE, allowing an out-of-bounds read and write. Limit read_len to the maximum size of the response buffer and return -EPROTO for an invalid response. Signed-off-by: Triet Hoang --- drivers/i2c/busses/i2c-cp2615.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-cp2615.c b/drivers/i2c/busses/i2c-cp2615.c index 951de6249834..2c79530da306 100644 --- a/drivers/i2c/busses/i2c-cp2615.c +++ b/drivers/i2c/busses/i2c-cp2615.c @@ -136,7 +136,7 @@ cp2615_i2c_send(struct usb_interface *usbif, struct cp2615_i2c_transfer *i2c_w) } static int -cp2615_i2c_recv(struct usb_interface *usbif, unsigned char tag, void *buf) +cp2615_i2c_recv(struct usb_interface *usbif, unsigned char tag, void *buf, int len) { struct usb_device *usbdev = interface_to_usbdev(usbif); struct cp2615_iop_msg *msg; @@ -160,6 +160,11 @@ cp2615_i2c_recv(struct usb_interface *usbif, unsigned char tag, void *buf) return -EIO; } + if (i2c_r->read_len > len || i2c_r->read_len > MAX_I2C_SIZE) { + kfree(msg); + return -EPROTO; + } + res = cp2615_check_status(i2c_r->status); if (!res) memcpy(buf, &i2c_r->data, i2c_r->read_len); @@ -236,7 +241,7 @@ cp2615_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) ret = cp2615_i2c_send(usbif, &i2c_w); if (ret) break; - ret = cp2615_i2c_recv(usbif, i2c_w.tag, msg->buf); + ret = cp2615_i2c_recv(usbif, i2c_w.tag, msg->buf, msg->len); } if (ret < 0) return ret; -- 2.53.0