github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-26 10:02:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

i2c: amd-asf: Validate firmware-reported length

Browse Source 
The firmware may sometimes return a length greater than the
allocated buffer size, which can lead to out-of-bounds access
and a kernel panic.

Currently, the driver does not validate the length read from
firmware.

Add a check to ensure the firmware-reported length stays within
the bounds of the data buffer.

Signed-off-by: Paritosh Potukuchi <paritosh.potukuchi@amd.com>
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260612101815.4124804-1-paritosh.potukuchi@amd.com
This commit is contained in:
Paritosh Potukuchi 2026-06-12 10:18:15 +00:00 committed by Andi Shyti
parent 3ca8d1ec9a
commit b2f4816a37
No known key found for this signature in database
GPG Key ID: DA78056626D32D6E
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/i2c/busses/i2c-amd-asf-plat.c
View File

@ -90,6 +90,10 @@ static void amd_asf_process_target(struct work_struct *work)
outb_p(reg, ASFDATABNKSEL);
cmd = inb_p(ASFINDEX);
len = inb_p(ASFDATARWPTR);
if (len > ASF_BLOCK_MAX_BYTES)
return;
for (idx = 0; idx < len; idx++)
data[idx] = inb_p(ASFINDEX);