NetBSD Problem Report #60913

From www@netbsd.org  Wed Oct 21 03:23:02 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 16E3A1A923C
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 21 Oct 2026 03:23:02 +0000 (UTC)
Message-Id: <20261021032300.9050E1A923E@mollari.NetBSD.org>
Date: Wed, 21 Oct 2026 03:23:00 +0000 (UTC)
From: trythepostoffice@gmail.com
Reply-To: trythepostoffice@gmail.com
To: gnats-bugs@NetBSD.org
Subject: iic(4): I2C_IOCTL_EXEC can copy out an uninitialised buffer
X-Send-Pr-Version: www-1.0
X-From4GNATS: "trythepostoffice@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60913
>Category:       kern
>Synopsis:       iic(4): I2C_IOCTL_EXEC can copy out an uninitialised buffer
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 21 03:25:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Thu Oct 22 17:20:01 +0000 2026
>Originator:     Elias Howell
>Release:        NetBSD 11.0, NetBSD-current 11.99.9 (20261019)
>Organization:
>Environment:
NetBSD armv7 11.0 NetBSD 11.0 (GENERIC) #0: Thu Jul 30 15:23:12 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm
NetBSD armv7 11.99.9 NetBSD 11.99.9 (GENERIC) #0: Mon Oct 19 09:38:27 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm

>Description:
iic_ioctl_exec() in sys/dev/i2c/i2c.c gets the read buffer with
kmem_alloc() and copies it out whenever the controller exec returns
0. If driver returns 0 without filling the buffer or only fills
part of it, up to I2C_EXEC_MAX_BUFLEN (4096) bytes of stale kernel
heap go to userland. /dev/iic* is root only by default so tis but a
small leak and not a privilege problem.

ti_iic(4) on AM335x does exactly that (PR port-arm/60912), lots of reads
from an address with nothing on it return 0. On 11.0 I got back 0x00,
0x01, 0x2f, 0x50, 0x60 or 0xf0 depending on the address and the run
with the userland buffer preset to 0xa5.

>How-To-Repeat:
See PR port-arm/60912. A 1 byte I2C_OP_READ_WITH_STOP at empty address
on AM335x iic0 without the ti_iic fix.
>Fix:
Zero the buffer. Tested on the SG-1000, -current b91976112 plus this
and my other patches with the ti_iic fix turned off by a sysctl in
the test kernel so reads still falsely succeed. Those now come back
0x00 every time (55 of 55 in a run of 120 reads at 0x24, 0x28 and
0x70).

--- a/sys/dev/i2c/i2c.c
+++ b/sys/dev/i2c/i2c.c
@@ -955,7 +955,7 @@ iic_ioctl_exec(struct iic_softc *sc, i2c_ioctl_exec_t *iie, int flag)
 	}

 	if (iie->iie_buf != NULL) {
-		buf = kmem_alloc(iie->iie_buflen, KM_SLEEP);
+		buf = kmem_zalloc(iie->iie_buflen, KM_SLEEP);
 		if (I2C_OP_WRITE_P(iie->iie_op)) {
 			error = copyin(iie->iie_buf, buf, iie->iie_buflen);
 			if (error)

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 21 Oct 2026 03:37:02 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60913 CVS commit: src/sys/dev/i2c
Date: Thu, 22 Oct 2026 17:19:27 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Oct 22 17:19:27 UTC 2026

 Modified Files:
 	src/sys/dev/i2c: i2c.c

 Log Message:
 i2c(4): Avoid leaking kernel heap memory to userland.

 PR kern/60913: iic(4): I2C_IOCTL_EXEC can copy out an uninitialised
 buffer


 To generate a diff of this commit:
 cvs rdiff -u -r1.108 -r1.109 src/sys/dev/i2c/i2c.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search