diff options
| author | Christian Marangi <ansuelsmth@gmail.com> | 2026-10-22 21:38:51 +0200 |
|---|---|---|
| committer | Andi Shyti <andi.shyti@kernel.org> | 2026-10-23 18:27:28 +0200 |
| commit | b7fd977fec0d3f2bdd4f13bb59949c817a365652 (patch) | |
| tree | dd1600abb902df015412afec302675640f89015f /drivers | |
| parent | 73dae605cad7921800677d982bfaeb81cc930dec (diff) | |
| download | linux-b7fd977fec0d3f2bdd4f13bb59949c817a365652.tar.gz linux-b7fd977fec0d3f2bdd4f13bb59949c817a365652.zip | |
i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len
When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
stack data is copied and written to REG_SM0D1_REG. Equally on the read
part, an unnecessary read is done.
Guard these extra copy/write and read for the page_len to fix leaking
uninitialized stack memory.
Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20261022193853.670625-1-ansuelsmth@gmail.com
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/i2c/busses/i2c-mt7621.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/i2c/busses/i2c-mt7621.c b/drivers/i2c/busses/i2c-mt7621.c index 0a288c998419..9ea5e3f9a763 100644 --- a/drivers/i2c/busses/i2c-mt7621.c +++ b/drivers/i2c/busses/i2c-mt7621.c @@ -144,7 +144,6 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, u16 addr; int i, j, ret, len, page_len; u32 cmd; - u32 data[2]; i2c = i2c_get_adapdata(adap); @@ -186,6 +185,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, /* transfer data */ for (len = pmsg->len, j = 0; len > 0; len -= 8, j += 8) { + u32 data[2] = { }; + page_len = (len >= 8) ? 8 : len; if (pmsg->flags & I2C_M_RD) { @@ -194,7 +195,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, } else { memcpy(data, &pmsg->buf[j], page_len); iowrite32(data[0], i2c->base + REG_SM0D0_REG); - iowrite32(data[1], i2c->base + REG_SM0D1_REG); + if (page_len > 4) + iowrite32(data[1], i2c->base + REG_SM0D1_REG); cmd = SM0CTL1_WRITE; } @@ -204,7 +206,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, if (pmsg->flags & I2C_M_RD) { data[0] = ioread32(i2c->base + REG_SM0D0_REG); - data[1] = ioread32(i2c->base + REG_SM0D1_REG); + if (page_len > 4) + data[1] = ioread32(i2c->base + REG_SM0D1_REG); memcpy(&pmsg->buf[j], data, page_len); } else { if (!(pmsg->flags & I2C_M_IGNORE_NAK)) { |