[PATCH RESEND] i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

[David Laight]

On Thu, 22 Oct 2026 21:38:51 +0200
Christian Marangi <ansuelsmth at gmail.com> wrote:

> When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
> stack data is copied and written to REG_SM0D1_REG. Equally on the read
> part, an unnecessary read is done.
> 
> Guard these extra copy/write and read for the page_len to fix leaking
> uninitialized stack memory.
> 
> Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
> Signed-off-by: Christian Marangi <ansuelsmth at gmail.com>
> ---
>  drivers/i2c/busses/i2c-mt7621.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/i2c/busses/i2c-mt7621.c b/drivers/i2c/busses/i2c-mt7621.c
> index 0a288c998419..9ea5e3f9a763 100644
> --- a/drivers/i2c/busses/i2c-mt7621.c
> +++ b/drivers/i2c/busses/i2c-mt7621.c
> @@ -144,7 +144,6 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
>  	u16 addr;
>  	int i, j, ret, len, page_len;
>  	u32 cmd;
> -	u32 data[2];
>  
>  	i2c = i2c_get_adapdata(adap);
>  
> @@ -186,6 +185,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
>  
>  		/* transfer data */
>  		for (len = pmsg->len, j = 0; len > 0; len -= 8, j += 8) {
> +			u32 data[2] = { };
> +
>  			page_len = (len >= 8) ? 8 : len;
>  
>  			if (pmsg->flags & I2C_M_RD) {
> @@ -194,7 +195,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
>  			} else {
>  				memcpy(data, &pmsg->buf[j], page_len);
>  				iowrite32(data[0], i2c->base + REG_SM0D0_REG);
> -				iowrite32(data[1], i2c->base + REG_SM0D1_REG);
> +				if (page_len > 4)
> +					iowrite32(data[1], i2c->base + REG_SM0D1_REG);

1) Why is this using memcpy() rather then just get_unaligned_u32().
   (Yes, short transfers get tricky...)
2) Have you checked whether the hardware requires both registers be
   read/written for correct operation.

David

>  				cmd = SM0CTL1_WRITE;
>  			}
>  
> @@ -204,7 +206,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
>  
>  			if (pmsg->flags & I2C_M_RD) {
>  				data[0] = ioread32(i2c->base + REG_SM0D0_REG);
> -				data[1] = ioread32(i2c->base + REG_SM0D1_REG);
> +				if (page_len > 4)
> +					data[1] = ioread32(i2c->base + REG_SM0D1_REG);
>  				memcpy(&pmsg->buf[j], data, page_len);
>  			} else {
>  				if (!(pmsg->flags & I2C_M_IGNORE_NAK)) {