github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

Browse Source 
When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
stack data is copied and written to REG_SM0D1_REG. Equally on the read
part, an unnecessary read is done.

Guard these extra copy/write and read for the page_len to fix leaking
uninitialized stack memory.

Fixes: d04913ec5f ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20261022193853.670625-1-ansuelsmth@gmail.com
This commit is contained in:
Christian Marangi 2026-10-22 21:38:51 +02:00 committed by Andi Shyti
parent 73dae605ca
commit b7fd977fec
No known key found for this signature in database
GPG Key ID: DA78056626D32D6E
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/i2c/busses/i2c-mt7621.c
View File

@ -144,7 +144,6 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
u16 addr;
int i, j, ret, len, page_len;
u32 cmd;
u32 data[2];
i2c = i2c_get_adapdata(adap);
@ -186,6 +185,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
/* transfer data */
for (len = pmsg->len, j = 0; len > 0; len -= 8, j += 8) {
u32 data[2] = { };
page_len = (len >= 8) ? 8 : len;
if (pmsg->flags & I2C_M_RD) {
@ -194,7 +195,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
} else {
memcpy(data, &pmsg->buf[j], page_len);
iowrite32(data[0], i2c->base + REG_SM0D0_REG);
iowrite32(data[1], i2c->base + REG_SM0D1_REG);
if (page_len > 4)
iowrite32(data[1], i2c->base + REG_SM0D1_REG);
cmd = SM0CTL1_WRITE;
}
@ -204,7 +206,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
if (pmsg->flags & I2C_M_RD) {
data[0] = ioread32(i2c->base + REG_SM0D0_REG);
data[1] = ioread32(i2c->base + REG_SM0D1_REG);
if (page_len > 4)
data[1] = ioread32(i2c->base + REG_SM0D1_REG);
memcpy(&pmsg->buf[j], data, page_len);
} else {
if (!(pmsg->flags & I2C_M_IGNORE_NAK)) {