diff options
| author | Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> | 2022-06-20 09:28:24 -0700 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2022-07-21 11:54:40 +0200 |
| commit | 62ac2473553a00229e67bdf3cb023b62cf7f5a9a (patch) | |
| tree | 0e190aa9d5101a22cef662e9964b9492b686d4a3 /drivers/hid | |
| parent | 54eed5c7b938dc4ef6b14d4ee048bbdafdbce352 (diff) | |
| download | linux-62ac2473553a00229e67bdf3cb023b62cf7f5a9a.tar.gz linux-62ac2473553a00229e67bdf3cb023b62cf7f5a9a.tar.bz2 linux-62ac2473553a00229e67bdf3cb023b62cf7f5a9a.zip | |
HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
Smatch Warning:
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
'&mcp->txbuf[5]' too small (59 vs 255)
drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
too small (34 vs 255)
The 'len' variable can take a value between 0-255 as it can come from
data->block[0] and it is user data. So add an bound check to prevent a
buffer overflow in memcpy().
Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-mcp2221.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c index 4211b9839209..de52e9f7bb8c 100644 --- a/drivers/hid/hid-mcp2221.c +++ b/drivers/hid/hid-mcp2221.c @@ -385,6 +385,9 @@ static int mcp_smbus_write(struct mcp2221 *mcp, u16 addr, data_len = 7; break; default: + if (len > I2C_SMBUS_BLOCK_MAX) + return -EINVAL; + memcpy(&mcp->txbuf[5], buf, len); data_len = len + 5; } |