queue-4.9/i2c-core-smbus-prevent-stack-corruption-on-read-i2c_block_data.patch

   1 From 89c6efa61f5709327ecfa24bff18e57a4e80c7fa Mon Sep 17 00:00:00 2001
   2 From: Jeremy Compostella <jeremy.compostella@intel.com>
   3 Date: Wed, 15 Nov 2017 12:31:44 -0700
   4 Subject: i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
   5
   6 From: Jeremy Compostella <jeremy.compostella@intel.com>
   7
   8 commit 89c6efa61f5709327ecfa24bff18e57a4e80c7fa upstream.
   9
  10 On a I2C_SMBUS_I2C_BLOCK_DATA read request, if data->block[0] is
  11 greater than I2C_SMBUS_BLOCK_MAX + 1, the underlying I2C driver writes
  12 data out of the msgbuf1 array boundary.
  13
  14 It is possible from a user application to run into that issue by
  15 calling the I2C_SMBUS ioctl with data.block[0] greater than
  16 I2C_SMBUS_BLOCK_MAX + 1.
  17
  18 This patch makes the code compliant with
  19 Documentation/i2c/dev-interface by raising an error when the requested
  20 size is larger than 32 bytes.
  21
  22 Call Trace:
  23  [<ffffffff8139f695>] dump_stack+0x67/0x92
  24  [<ffffffff811802a4>] panic+0xc5/0x1eb
  25  [<ffffffff810ecb5f>] ? vprintk_default+0x1f/0x30
  26  [<ffffffff817456d3>] ? i2cdev_ioctl_smbus+0x303/0x320
  27  [<ffffffff8109a68b>] __stack_chk_fail+0x1b/0x20
  28  [<ffffffff817456d3>] i2cdev_ioctl_smbus+0x303/0x320
  29  [<ffffffff81745aed>] i2cdev_ioctl+0x4d/0x1e0
  30  [<ffffffff811f761a>] do_vfs_ioctl+0x2ba/0x490
  31  [<ffffffff81336e43>] ? security_file_ioctl+0x43/0x60
  32  [<ffffffff811f7869>] SyS_ioctl+0x79/0x90
  33  [<ffffffff81a22e97>] entry_SYSCALL_64_fastpath+0x12/0x6a
  34
  35 Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
  36 Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
  37 Cc: stable@kernel.org
  38 [connoro@google.com: 4.9 backport: adjust filename]
  39 Signed-off-by: Connor O'Brien <connoro@google.com>
  40 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  41
  42 ---
  43  drivers/i2c/i2c-core.c |   12 ++++++------
  44  1 file changed, 6 insertions(+), 6 deletions(-)
  45
  46 --- a/drivers/i2c/i2c-core.c
  47 +++ b/drivers/i2c/i2c-core.c
  48 @@ -3250,16 +3250,16 @@ static s32 i2c_smbus_xfer_emulated(struc
  49                                    the underlying bus driver */
  50                 break;
  51         case I2C_SMBUS_I2C_BLOCK_DATA:
  52 +               if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {
  53 +                       dev_err(&adapter->dev, "Invalid block %s size %d\n",
  54 +                               read_write == I2C_SMBUS_READ ? "read" : "write",
  55 +                               data->block[0]);
  56 +                       return -EINVAL;
  57 +               }
  58                 if (read_write == I2C_SMBUS_READ) {
  59                         msg[1].len = data->block[0];
  60                 } else {
  61                         msg[0].len = data->block[0] + 1;
  62 -                       if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {
  63 -                               dev_err(&adapter->dev,
  64 -                                       "Invalid block write size %d\n",
  65 -                                       data->block[0]);
  66 -                               return -EINVAL;
  67 -                       }
  68                         for (i = 1; i <= data->block[0]; i++)
  69                                 msgbuf0[i] = data->block[i];
  70                 }