eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
Jonas Malaco authored
commit c0689e46 upstream.

Commit effa4531 ("i2c: i801: Don't silently correct invalid transfer
size") revealed that ee1004_eeprom_read() did not properly limit how
many bytes to read at once.

In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the
length to read as an u8.  If count == 256 after taking into account the
offset and page boundary, the cast to u8 overflows.  And this is common
when user space tries to read the entire EEPROM at once.

To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already
the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.

Fixes: effa4531

 ("i2c: i801: Don't silently correct invalid transfer size")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: default avatarJonas Malaco <jonas@protocubo.io>
Link: https://lore.kernel.org/r/20220203165024.47767-1-jonas@protocubo.io

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
3937c354
Name Last commit Last update
Documentation bpf: Add kconfig knob for disabling unpriv bpf by default
LICENSES LICENSES: Rename other to deprecated
arch ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
block block: bio-integrity: Advance seed correctly for larger interval sizes
certs certs: Trigger creation of RSA module signing key if it's not an RSA key
crypto crypto: pcrypt - Delay write to padata->info
drivers eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
fs NFSv4 expose nfs_parse_server_name function
include net: fix a memleak when uncloning an skb dst and its metadata
init bpf: Add kconfig knob for disabling unpriv bpf by default
ipc shm: extend forced shm destroy to support objects from several IPC nses
kernel PM: s2idle: ACPI: Fix wakeup interrupts handling
lib lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
mm mm/kmemleak: avoid scanning potential huge holes
net tipc: rate limit warning for received illegal binding update
samples samples/kretprobes: Fix return value if register_kretprobe() failed
scripts scripts/dtc: dtx_diff: remove broken example from help text
security ima: Do not print policy rule with inactive LSM labels
sound ASoC: max9759: fix underflow in speaker_gain_control_put()
tools perf probe: Fix ppc64 'perf probe add events failed' case
usr initramfs: restore default compression behavior
virt KVM: do not shrink halt_poll_ns below grow_start
.clang-format clang-format: Update with the latest for_each macro list
.cocciconfig scripts: add Linux .cocciconfig for coccinelle
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl
.gitattributes .gitattributes: set git diff driver for C source code files
.gitignore Merge tag 'modules-for-v5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux
.mailmap Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
COPYING COPYING: use the new text with points to the license files
CREDITS MAINTAINERS: Remove Simon as Renesas SoC Co-Maintainer
Kbuild kbuild: do not descend to ./Kbuild when cleaning
Kconfig docs: kbuild: convert docs to ReST and rename to *.rst
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM
Makefile Linux 5.4.179
README Drop all 00-INDEX files from Documentation/
Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.