diff options
| author | Alex Guo <[email protected]> | 2025-08-10 18:05:13 +0000 |
|---|---|---|
| committer | Andi Shyti <[email protected]> | 2025-08-19 21:17:56 +0000 |
| commit | 57f312b955938fc4663f430cb57a71f2414f601b (patch) | |
| tree | 588c3cca1d5745ea68ff4aff3c9e251fddbf03a7 /drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | |
| parent | MAINTAINERS: i2c: Update i2c_hisi entry (diff) | |
| download | kernel-57f312b955938fc4663f430cb57a71f2414f601b.tar.gz kernel-57f312b955938fc4663f430cb57a71f2414f601b.zip | |
i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer
The data->block[0] variable comes from user. Without proper check,
the variable may be very large to cause an out-of-bounds bug.
Fix this bug by checking the value of data->block[0] first.
1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
ismt_access()")
2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
xgene_slimpro_i2c_xfer()")
Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
Signed-off-by: Alex Guo <[email protected]>
Cc: <[email protected]> # v6.13+
Reviewed-by: Chris Packham <[email protected]>
Tested-by: Chris Packham <[email protected]>
Reviewed-by: Wolfram Sang <[email protected]>
Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Andi Shyti <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c')
0 files changed, 0 insertions, 0 deletions