diff options
| author | Arnaud Lecomte <contact@arnaud-lcm.com> | 2025-07-26 23:09:31 +0100 |
|---|---|---|
| committer | Benjamin Tissoires <bentiss@kernel.org> | 2025-08-13 10:49:16 +0200 |
| commit | b56cc41a3ae7323aa3c6165f93c32e020538b6d2 (patch) | |
| tree | 9ff97f49e2d47e7f2db1757e629de2113acf5c21 /lib/xarray.c | |
| parent | 9fc51941d9e7793da969b2c66e6f8213c5b1237f (diff) | |
hid: fix I2C read buffer overflow in raw_event() for mcp2221
As reported by syzbot, mcp2221_raw_event lacked
validation of incoming I2C read data sizes, risking buffer
overflows in mcp->rxbuf during multi-part transfers.
As highlighted in the DS20005565B spec, p44, we have:
"The number of read-back data bytes to follow in this packet:
from 0 to a maximum of 60 bytes of read-back bytes."
This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346
Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Diffstat (limited to 'lib/xarray.c')
0 files changed, 0 insertions, 0 deletions