Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217488/?format=api
{ "id": 2217488, "url": "http://patchwork.ozlabs.org/api/patches/2217488/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-i2c/patch/20260329164126.820797-2-bestswngs@gmail.com/", "project": { "id": 35, "url": "http://patchwork.ozlabs.org/api/projects/35/?format=api", "name": "Linux I2C development", "link_name": "linux-i2c", "list_id": "linux-i2c.vger.kernel.org", "list_email": "linux-i2c@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260329164126.820797-2-bestswngs@gmail.com>", "list_archive_url": null, "date": "2026-03-29T16:41:27", "name": "i2c: stub: Reject I2C block transfers exceeding I2C_SMBUS_BLOCK_MAX", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "224d7883e346d4a6f3f6b82f12d0f6133f2e96e3", "submitter": { "id": 92941, "url": "http://patchwork.ozlabs.org/api/people/92941/?format=api", "name": "Weiming Shi", "email": "bestswngs@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-i2c/patch/20260329164126.820797-2-bestswngs@gmail.com/mbox/", "series": [ { "id": 497930, "url": "http://patchwork.ozlabs.org/api/series/497930/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-i2c/list/?series=497930", "date": "2026-03-29T16:41:27", "name": "i2c: stub: Reject I2C block transfers exceeding I2C_SMBUS_BLOCK_MAX", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497930/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217488/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217488/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-i2c+bounces-16859-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-i2c@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=F4RciwCj;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=linux-i2c+bounces-16859-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"F4RciwCj\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.215.172", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fkKyR0Njdz1xtJ\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 30 Mar 2026 03:46:06 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 41FCC300E5E8\n\tfor <incoming@patchwork.ozlabs.org>; Sun, 29 Mar 2026 16:42:18 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 3392F3806D2;\n\tSun, 29 Mar 2026 16:42:15 +0000 (UTC)", "from mail-pg1-f172.google.com (mail-pg1-f172.google.com\n [209.85.215.172])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id B22F53806D7\n\tfor <linux-i2c@vger.kernel.org>; Sun, 29 Mar 2026 16:42:13 +0000 (UTC)", "by mail-pg1-f172.google.com with SMTP id\n 41be03b00d2f7-c70bfef17a4so2731635a12.2\n for <linux-i2c@vger.kernel.org>; Sun, 29 Mar 2026 09:42:13 -0700 (PDT)", "from SLSGDTSWING002.tail0ac356.ts.net ([129.126.109.177])\n by smtp.gmail.com with ESMTPSA id\n 41be03b00d2f7-c76917db770sm4015782a12.32.2026.03.29.09.42.10\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Sun, 29 Mar 2026 09:42:12 -0700 (PDT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1774802534; cv=none;\n b=seBd8LMlwcoZlWuZGfryCHZN15oVQxRZQKe23b2RAbgToQEx8RIOTkycnPKArrQuvMfUdHcz8BhnlUsK5p5nSder+8jzTuIGJ6rDf4PnOEDeI+DkaqnljBIhYy/frX26TZGv6CMM78ky/Cd+F8T28d94QUhqDHdt7ip0oeBgHKA=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1774802534; c=relaxed/simple;\n\tbh=2dXv0nAmkiJYZS9eDr+LvkacZkKKtj06sR29apGbOlA=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=LyORl7vLEp+ZKmg4IzdwbRRamU7Rhn6org+cAT6AOc7ZplmNGqt3JCmWowokOfPSig6YVbZ2ZgJ/vM6gr50z3ZnwTtbtWXJM7A4y3/kmawE1LAYWaHvntzMN6fN+UemWCy2cUA9L+sjZxV/MXWft132GKX8l55FO6GnZ9HbZfrs=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=F4RciwCj; arc=none smtp.client-ip=209.85.215.172", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1774802533; x=1775407333;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=/VkDaEIdx6Ux33QpjDJoUSEWWsuae4zX/E6ZQCjaiTQ=;\n b=F4RciwCjvn/pHxGD62ig0g0o86nHs95fXMGst5NFVwggi4MpTufD5MoqeaWirlzDPn\n IpzfjxMQn7BL+6ZfrzUE/69g4E/7YMGmlr/GBFbU3CGKAAWWVFfstPAj+a/efgkbwzMR\n shzSK2/bDDF/x1yPG+fv9Ntw35y9DiCapUHtiQG3Sy3m1uHGtDKquwjP+G0sjmr4PxEu\n viWfvwaWud+3FwT4FdlYGw4hjprjrZ+t3+j9px9DahIwzEspzlypY7vyS036cUYyFaEn\n VjH40wuTHuC4O4kC5kBetHd9HrLcpfrNCd/gL0IozAGd5j5VKSRKfZDfGOQSZi68iRGa\n KLDA==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774802533; x=1775407333;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=/VkDaEIdx6Ux33QpjDJoUSEWWsuae4zX/E6ZQCjaiTQ=;\n b=gvxgcd0ZyWTg8ZR662KnVnFjp+eB9K1EsIBQUT3A+NDISKbW+TXDdP58ld9tUPg25E\n 8rN7J5KAWugWnQoBZ/KOQ+5inElWqplmJS2yqNc/1+VIMLGL8eeevj/0kWBrLkcaGNNa\n +SUmWRchpHwwt8aPjgnFkVGqlRF2Bp+fAQPAtQy7dsa3QiLAw3k+6h9dBfxRLojdbc2F\n KAhH2BxEhSp7cnvwdc3UoINwpE+5BedCu/97TDeZgc2IFiJWDECRrHtAFf5uBfi6cRUz\n Cp6/A1eB9fCh6h5z59qFyNAiRv/i+rMvZ7fJ+no5/D4UM3uqdmtD9yItpvfWLBNU7ZkE\n Iewg==", "X-Gm-Message-State": "AOJu0YwCPTbZxC2EtWVE8NkIorvsmmuKv9HNmc6tqABcKWBjtW42ttsZ\n\tRVxCi4qjn+Wjh6BX83+nYO9phnjldIXKKxngMDzkHhl7aK3UWpgGIIw5", "X-Gm-Gg": "ATEYQzwnQoqAd2OghMuqbveZq6zSLmjyMa12kitZo7pD7J49iNp8Y1V+bIXLIojRc+W\n\txc4etdBfzi0ub0+/ORXZ1cGAIGdeB5a76vBQ4dxi9HtAANqWjNi6VgjUMOyWKRuEH2FBvixrk+2\n\tusLumhUqFGhasJfXtFerLKUeydsRIlMNv4vf9Y6vW9P/PU+JNDfvPHwHN5AOjPr0EERDVWBxeMA\n\tCaT6F3ymQ1s+1zp1rnwV1e0R8RaAxeOy3XuMsrAfaLPjCl3ngXXy3mX/3559ug4+tylLBT5IVz5\n\tG2Bw4VGgWLpV2SNEgmckB4L5jlLfOCZBnJ4F3XHfPUJgnCjQUosV+t1APhbiYh9Qotz4eTsRmBn\n\trgsX92gYOYbHDiGiT4iVvb9SxtxuA7R1bQbiIlA/d92+b/SAbQ5+joCl6UfFkcx5Arr0eBw7AqV\n\td25dibaga1C2yxurkStsSILMq240R4NHOHSuwkDVQ7TolJfKByyN5O5K0g1t4re7cCiHnYjDMp0\n\toy3ocPMxmwB", "X-Received": "by 2002:a05:6a20:7d9b:b0:39b:e321:784e with SMTP id\n adf61e73a8af0-39c87c40488mr9199781637.60.1774802532982;\n Sun, 29 Mar 2026 09:42:12 -0700 (PDT)", "From": "Weiming Shi <bestswngs@gmail.com>", "To": "Wolfram Sang <wsa+renesas@sang-engineering.com>,\n\tJean Delvare <jdelvare@suse.com>", "Cc": "linux-i2c@vger.kernel.org,\n\tXiang Mei <xmei5@asu.edu>,\n\tWeiming Shi <bestswngs@gmail.com>,\n\tstable@vger.kernel.org", "Subject": "[PATCH] i2c: stub: Reject I2C block transfers exceeding\n I2C_SMBUS_BLOCK_MAX", "Date": "Mon, 30 Mar 2026 00:41:27 +0800", "Message-ID": "<20260329164126.820797-2-bestswngs@gmail.com>", "X-Mailer": "git-send-email 2.43.0", "Precedence": "bulk", "X-Mailing-List": "linux-i2c@vger.kernel.org", "List-Id": "<linux-i2c.vger.kernel.org>", "List-Subscribe": "<mailto:linux-i2c+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-i2c+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip->words[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n <TASK>\n stub_xfer (drivers/i2c/i2c-stub.c:223)\n __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n __x64_sys_ioctl (fs/ioctl.c:583)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n </TASK>\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting oversized transfers with -EINVAL when\ndata->block[0] exceeds I2C_SMBUS_BLOCK_MAX, consistent with both\nthe I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().\n\nFixes: 4710317891e4 (\"i2c-stub: Implement I2C block support\")\nCc: stable@vger.kernel.org\nReported-by: Xiang Mei <xmei5@asu.edu>\nSigned-off-by: Weiming Shi <bestswngs@gmail.com>\n---\n drivers/i2c/i2c-stub.c | 4 ++++\n 1 file changed, 4 insertions(+)", "diff": "diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c\nindex fbb0db41b10e1..349ef9fb2fdbc 100644\n--- a/drivers/i2c/i2c-stub.c\n+++ b/drivers/i2c/i2c-stub.c\n@@ -214,6 +214,10 @@ static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags,\n \t\t * We ignore banks here, because banked chips don't use I2C\n \t\t * block transfers\n \t\t */\n+\t\tif (data->block[0] > I2C_SMBUS_BLOCK_MAX) {\n+\t\t\tret = -EINVAL;\n+\t\t\tbreak;\n+\t\t}\n \t\tif (data->block[0] > 256 - command)\t/* Avoid overrun */\n \t\t\tdata->block[0] = 256 - command;\n \t\tlen = data->block[0];\n", "prefixes": [] }