• Benjamin Tissoires's avatar
    Input: elan_i2c_smbus - fix corrupted stack · 40f7090b
    Benjamin Tissoires authored
    New ICs (like the one on the Lenovo T480s) answer to
    ETP_SMBUS_IAP_VERSION_CMD 4 bytes instead of 3. This corrupts the stack
    as i2c_smbus_read_block_data() uses the values returned by the i2c
    device to know how many data it need to return.
    
    i2c_smbus_read_block_data() can read up to 32 bytes (I2C_SMBUS_BLOCK_MAX)
    and there is no safeguard on how many bytes are provided in the return
    value. Ensure we always have enough space for any future firmware.
    Also 0-initialize the values to prevent any access to uninitialized memory.
    
    Cc: <stable@vger.kernel.org> # v4.4.x, v4.9.x, v4.14.x, v4.15.x, v4.16.x
    Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
    Acked-by: default avatarKT Liao <kt.liao@emc.com.tw>
    Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
    40f7090b
elan_i2c_smbus.c 12.6 KB