fdab04c119
commit 40f7090bb1b4ec327ea1e1402ff5783af5b35195 upstream. New ICs (like the one on the Lenovo T480s) answer to ETP_SMBUS_IAP_VERSION_CMD 4 bytes instead of 3. This corrupts the stack as i2c_smbus_read_block_data() uses the values returned by the i2c device to know how many data it need to return. i2c_smbus_read_block_data() can read up to 32 bytes (I2C_SMBUS_BLOCK_MAX) and there is no safeguard on how many bytes are provided in the return value. Ensure we always have enough space for any future firmware. Also 0-initialize the values to prevent any access to uninitialized memory. Cc: <stable@vger.kernel.org> # v4.4.x, v4.9.x, v4.14.x, v4.15.x, v4.16.x Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: KT Liao <kt.liao@emc.com.tw> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| gameport | ||
| joystick | ||
| keyboard | ||
| misc | ||
| mouse | ||
| serio | ||
| tablet | ||
| touchscreen | ||
| apm-power.c | ||
| evbug.c | ||
| evdev.c | ||
| ff-core.c | ||
| ff-memless.c | ||
| input-compat.c | ||
| input-compat.h | ||
| input-leds.c | ||
| input-mt.c | ||
| input-polldev.c | ||
| input.c | ||
| joydev.c | ||
| Kconfig | ||
| Makefile | ||
| matrix-keymap.c | ||
| mousedev.c | ||
| sparse-keymap.c | ||