Re: [PATCH i2c-host-fixes v4 1/5] i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

[Wolfram Sang]

On Sat, Aug 09, 2025 at 08:40:54AM +0200, Sven Eckelmann wrote:
> From: Alex Guo <alexguo1023@xxxxxxxxx>
> 
> The data->block[0] variable comes from user. Without proper check,
> the variable may be very large to cause an out-of-bounds bug.
> 
> Fix this bug by checking the value of data->block[0] first.
> 
> 1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
>    ismt_access()")
> 2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
>    xgene_slimpro_i2c_xfer()")
> 
> Cc: <stable@xxxxxxxxxxxxxxx>
> Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
> Signed-off-by: Alex Guo <alexguo1023@xxxxxxxxx>
> Reviewed-by: Chris Packham <chris.packham@xxxxxxxxxxxxxxxxxxx>
> Tested-by: Chris Packham <chris.packham@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Sven Eckelmann <sven@xxxxxxxxxxxxx>

Reviewed-by: Wolfram Sang <wsa+renesas@xxxxxxxxxxxxxxxxxxxx>

Attachment: signature.asc
Description: PGP signature