From nobody Mon Dec 1 21:31:19 2025 Received: from out-182.mta1.migadu.com (out-182.mta1.migadu.com [95.215.58.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A34392E6CC7 for ; Fri, 28 Nov 2025 08:06:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764317209; cv=none; b=JdT4Hw5ZDCCGcyJV4GYK4O3vNbrnpriFCKxDFc1Bs4C6K89X08H1KpY60PuDmLxnD71azB6clI/p1w+bJDe5YfOs5XW+bC5TG+3/1FXcXMKUT8DVd+uvFtGpUMepXyTKDQn8sZEHobW/kvvQ3/4g/C3ImBxQqLJ9Pm3+ZibauH0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764317209; c=relaxed/simple; bh=PaRuPo/8d18hXOSOrZZmdayCy4RSaURgt88N6VVQF5k=; h=Date:From:To:Cc:Subject:Message-Id:Mime-Version:Content-Type; b=XXcuNX+BZL6xfL2f6kIJTNpaaCC5j/YjD9h3OI08d1a/f8CQzv791CKH+iAm3Qva272GUCZn/9qkbqogiLUh83PD0VCbB266A6ZMC98dCINmbyZBw14SPa9EcYnwTzrV/RCKbp37041TtP9rlLhIzePKopwcxbSqJQaZjcFajas= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=p+6a6G2M; arc=none smtp.client-ip=95.215.58.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="p+6a6G2M" Date: Fri, 28 Nov 2025 16:06:30 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1764317204; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xyLFdyMwZ35EJDPF/oEQsYS5adqqktBJr+Gd6bwHb1s=; b=p+6a6G2MkCuAkyVcpkoCUGlMHQvfw7oFTHgM6kKGth5gHzu2BDjbMOSdcKoYNhmVDiEd7g QKotHrcaGmyiGLiG4shNZ2XfKoSuB6KQgwCICyoA78UEpVMnRIVDqyDAvmeHcDCqVYlw7U NDF+aEYGhSdDubKw7lRlZL59LFT/COc= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Tianchu Chen To: broonie@kernel.org Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org Subject: [PATCH] spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Message-Id: <20251128160630.0f922c45ec6084a46fb57099@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Tianchu Chen Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes. Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Signed-off-by: Tianchu Chen --- drivers/spi/spi-ch341.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c index 46bc208f2..79d2f9ab4 100644 --- a/drivers/spi/spi-ch341.c +++ b/drivers/spi/spi-ch341.c @@ -78,7 +78,7 @@ static int ch341_transfer_one(struct spi_controller *host, =20 ch341->tx_buf[0] =3D CH341A_CMD_SPI_STREAM; =20 - memcpy(ch341->tx_buf + 1, trans->tx_buf, len); + memcpy(ch341->tx_buf + 1, trans->tx_buf, len - 1); =20 ret =3D usb_bulk_msg(ch341->udev, ch341->write_pipe, ch341->tx_buf, len, NULL, CH341_DEFAULT_TIMEOUT); --=20 2.39.5