Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs in pt5161l_read_block_data(): 1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24], but i2c_smbus_read_block_data() can return up to I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies the data into the caller's buffer before the return value can be checked, so the post-read length validation does not prevent a stack overrun if a device returns more than 24 bytes. Resize the buffer to I2C_SMBUS_BLOCK_MAX. 2. Unexpected positive return on length mismatch: When all three retries are exhausted because the device returns data with an unexpected length, i2c_smbus_read_block_data() returns a positive byte count. The function returns this directly, and callers treat any non-negative return as success, processing stale or incomplete buffer contents. Return -EIO when retries are exhausted with a positive return value, preserving the negative error code on I2C failure.
Product status
1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 (git) before 7eccabff1c9ec15e4b6fe186d5c147b13a9cdb4e
1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 (git) before 95d48e37a1304d6148406c799479c0fb505aefa7
1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 (git) before a11aa9c5fd9dfe62be7cfec1f2a7546afb77254c
1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 (git) before 24c73e93d6a756e1b8626bb259d2e07c5b89b370
6.9
Any version before 6.9
6.12.86 (semver)
6.18.27 (semver)
7.0.4 (semver)
7.1-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/7eccabff1c9ec15e4b6fe186d5c147b13a9cdb4e
git.kernel.org/...c/95d48e37a1304d6148406c799479c0fb505aefa7
git.kernel.org/...c/a11aa9c5fd9dfe62be7cfec1f2a7546afb77254c
git.kernel.org/...c/24c73e93d6a756e1b8626bb259d2e07c5b89b370