diff --git a/patches.suse/i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgene_sli.patch b/patches.suse/i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgene_sli.patch new file mode 100644 index 0000000..294f202 --- /dev/null +++ b/patches.suse/i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgene_sli.patch @@ -0,0 +1,40 @@ +From: Wei Chen +Date: Tue, 14 Mar 2023 16:54:21 +0000 +Subject: i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() +Patch-mainline: v6.3-rc4 +Git-commit: 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 +References: bsc#1210715 CVE-2023-2194 + +The data->block[0] variable comes from user and is a number between +0-255. Without proper check, the variable may be very large to cause +an out-of-bounds when performing memcpy in slimpro_i2c_blkwr. + +Fix this bug by checking the value of writelen. + +Fixes: f6505fbabc42 ("i2c: add SLIMpro I2C device driver on APM X-Gene platform") +Signed-off-by: Wei Chen +Cc: stable@vger.kernel.org +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Acked-by: Lee, Chun-Yi +--- + drivers/i2c/busses/i2c-xgene-slimpro.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c +index 63259b3ea5ab..3538d36368a9 100644 +--- a/drivers/i2c/busses/i2c-xgene-slimpro.c ++++ b/drivers/i2c/busses/i2c-xgene-slimpro.c +@@ -308,6 +308,9 @@ static int slimpro_i2c_blkwr(struct slimpro_i2c_dev *ctx, u32 chip, + u32 msg[3]; + int rc; + ++ if (writelen > I2C_SMBUS_BLOCK_MAX) ++ return -EINVAL; ++ + memcpy(ctx->dma_buffer, data, writelen); + paddr = dma_map_single(ctx->dev, ctx->dma_buffer, writelen, + DMA_TO_DEVICE); +-- +2.35.3 + diff --git a/series.conf b/series.conf index a1b8702..e6c9277 100644 --- a/series.conf +++ b/series.conf @@ -23114,6 +23114,7 @@ patches.suse/xirc2ps_cs-Fix-use-after-free-bug-in-xirc2ps_detach.patch patches.suse/net-qcom-emac-Fix-use-after-free-bug-in-emac_remove-.patch patches.suse/Bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch + patches.suse/i2c-xgene-slimpro-Fix-out-of-bounds-bug-in-xgene_sli.patch patches.suse/power-supply-da9150-Fix-use-after-free-bug-in-da9150.patch patches.suse/btrfs-fix-race-between-quota-disable-and-quota-assig.patch patches.suse/cifs-fix-negotiate-context-parsing.patch