From b2f4816a378dc840b605a1235b80e57c5f85b46c Mon Sep 17 00:00:00 2001 From: Paritosh Potukuchi Date: Fri, 12 Jun 2026 10:18:15 +0000 Subject: [PATCH] i2c: amd-asf: Validate firmware-reported length The firmware may sometimes return a length greater than the allocated buffer size, which can lead to out-of-bounds access and a kernel panic. Currently, the driver does not validate the length read from firmware. Add a check to ensure the firmware-reported length stays within the bounds of the data buffer. Signed-off-by: Paritosh Potukuchi Acked-by: Shyam Sundar S K Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260612101815.4124804-1-paritosh.potukuchi@amd.com --- drivers/i2c/busses/i2c-amd-asf-plat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/i2c/busses/i2c-amd-asf-plat.c b/drivers/i2c/busses/i2c-amd-asf-plat.c index ca45f0f23321..f5b73c834049 100644 --- a/drivers/i2c/busses/i2c-amd-asf-plat.c +++ b/drivers/i2c/busses/i2c-amd-asf-plat.c @@ -90,6 +90,10 @@ static void amd_asf_process_target(struct work_struct *work) outb_p(reg, ASFDATABNKSEL); cmd = inb_p(ASFINDEX); len = inb_p(ASFDATARWPTR); + + if (len > ASF_BLOCK_MAX_BYTES) + return; + for (idx = 0; idx < len; idx++) data[idx] = inb_p(ASFINDEX);