linux-toradex.git/drivers/misc/eeprom, branch v5.17 Linux kernel for Apalis and Colibri modules eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX 2022-02-04T15:27:44+00:00 Jonas Malaco jonas@protocubo.io 2022-02-03T16:49:52+00:00 c0689e46be23160d925dca95dfc411f1a0462708 Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length to read as an u8. If count == 256 after taking into account the offset and page boundary, the cast to u8 overflows. And this is common when user space tries to read the entire EEPROM at once. To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows. Fixes: effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") Cc: stable@vger.kernel.org Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Jonas Malaco <jonas@protocubo.io> Link: https://lore.kernel.org/r/20220203165024.47767-1-jonas@protocubo.io Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer
size") revealed that ee1004_eeprom_read() did not properly limit how
many bytes to read at once.

In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the
length to read as an u8.  If count == 256 after taking into account the
offset and page boundary, the cast to u8 overflows.  And this is common
when user space tries to read the entire EEPROM at once.

To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already
the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.

Fixes: effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size")
Cc: stable@vger.kernel.org
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Jonas Malaco <jonas@protocubo.io>
Link: https://lore.kernel.org/r/20220203165024.47767-1-jonas@protocubo.io
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eeprom: at25: Restore missing allocation 2022-01-22T12:32:48+00:00 Kees Cook keescook@chromium.org 2022-01-18T18:20:03+00:00 a6501e4b380faee6bbf41bb2f833977c7ac6491a The at25 driver regressed in v5.17-rc1 due to a broken conflict resolution: the allocation of the object was accidentally removed. Restore it. This was found when building under CONFIG_FORTIFY_SOURCE=y and -Warray-bounds, which complained about strncpy() being used against an empty object: In function 'strncpy', inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2: ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds] 48 | #define __underlying_strncpy __builtin_strncpy | ^ ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy' 59 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ In function 'strncpy', inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2, inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10: ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds] 48 | #define __underlying_strncpy __builtin_strncpy | ^ ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy' 59 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ Link: https://lore.kernel.org/lkml/CAHp75VdqK7h63fz-cPaQ2MGaVdaR2f1Fb5kKCZidUG3RwLsAVA@mail.gmail.com/ Fixes: af40d16042d6 ("Merge v5.15-rc5 into char-misc-next") Cc: Arnd Bergmann <arnd@arndb.de> Cc: Jiri Prchal <jiri.prchal@aksignal.cz> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220118182003.3385019-1-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The at25 driver regressed in v5.17-rc1 due to a broken conflict
resolution: the allocation of the object was accidentally removed. Restore
it.

This was found when building under CONFIG_FORTIFY_SOURCE=y and
-Warray-bounds, which complained about strncpy() being used against an
empty object:

In function 'strncpy',
    inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2:
./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
   48 | #define __underlying_strncpy    __builtin_strncpy
      |                                 ^
./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
   59 |         return __underlying_strncpy(p, q, size);
      |                ^~~~~~~~~~~~~~~~~~~~
In function 'strncpy',
    inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2,
    inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10:
./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
   48 | #define __underlying_strncpy    __builtin_strncpy
      |                                 ^
./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
   59 |         return __underlying_strncpy(p, q, size);
      |                ^~~~~~~~~~~~~~~~~~~~

Link: https://lore.kernel.org/lkml/CAHp75VdqK7h63fz-cPaQ2MGaVdaR2f1Fb5kKCZidUG3RwLsAVA@mail.gmail.com/
Fixes: af40d16042d6 ("Merge v5.15-rc5 into char-misc-next")
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Jiri Prchal <jiri.prchal@aksignal.cz>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220118182003.3385019-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2022-01-14T15:19:38+00:00 Linus Torvalds torvalds@linux-foundation.org 2022-01-14T15:19:38+00:00 112450df61b7373529b0fe4c122ad13b89d80a8a Pull i2c updates from Wolfram Sang: "Mostly driver updates and refactorization. The removal of the XLR driver and the i801 refactoring stand out a little. In the core, we enabled async suspend/resume for I2C controllers and their clients. No issues were reported during the test phase in -next. We will see how this goes for mainline" * 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (54 commits) i2c: sh_mobile: remove unneeded semicolon i2c: riic: Use platform_get_irq() to get the interrupt i2c: sh_mobile: Use platform_get_irq_optional() to get the interrupt i2c: bcm2835: Use platform_get_irq() to get the interrupt i2c: aspeed: Remove unused includes dt-bindings: i2c: aspeed: Drop stray '#interrupt-cells' i2c: sh_mobile: update to new DMAENGINE API when terminating i2c: rcar: update to new DMAENGINE API when terminating i2c: exynos5: Fix getting the optional clock i2c: designware-pci: Convert to use dev_err_probe() i2c: designware-pci: use __maybe_unused for PM functions i2c: designware-pci: Group MODULE_*() macros i2c: designware-pci: Add a note about struct dw_scl_sda_cfg usage i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters i2c: designware: Do not complete i2c read without RX_FULL interrupt eeprom: at24: Add support for 24c1025 EEPROM dt-bindings: at24: add at24c1025 i2c: tegra: use i2c_timings for bus clock freq dt-bindings: at24: Rework special case compatible handling i2c: i801: Don't clear status flags twice in interrupt mode ... 
Pull i2c updates from Wolfram Sang:
 "Mostly driver updates and refactorization.

  The removal of the XLR driver and the i801 refactoring stand out a
  little. In the core, we enabled async suspend/resume for I2C
  controllers and their clients. No issues were reported during the test
  phase in -next. We will see how this goes for mainline"

* 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (54 commits)
  i2c: sh_mobile: remove unneeded semicolon
  i2c: riic: Use platform_get_irq() to get the interrupt
  i2c: sh_mobile: Use platform_get_irq_optional() to get the interrupt
  i2c: bcm2835: Use platform_get_irq() to get the interrupt
  i2c: aspeed: Remove unused includes
  dt-bindings: i2c: aspeed: Drop stray '#interrupt-cells'
  i2c: sh_mobile: update to new DMAENGINE API when terminating
  i2c: rcar: update to new DMAENGINE API when terminating
  i2c: exynos5: Fix getting the optional clock
  i2c: designware-pci: Convert to use dev_err_probe()
  i2c: designware-pci: use __maybe_unused for PM functions
  i2c: designware-pci: Group MODULE_*() macros
  i2c: designware-pci: Add a note about struct dw_scl_sda_cfg usage
  i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
  i2c: designware: Do not complete i2c read without RX_FULL interrupt
  eeprom: at24: Add support for 24c1025 EEPROM
  dt-bindings: at24: add at24c1025
  i2c: tegra: use i2c_timings for bus clock freq
  dt-bindings: at24: Rework special case compatible handling
  i2c: i801: Don't clear status flags twice in interrupt mode
  ...
eeprom: at24: Add support for 24c1025 EEPROM 2021-12-13T13:42:39+00:00 Maxim Kochetkov fido_max@inbox.ru 2021-12-10T18:26:03+00:00 d08aea21c89dc2d302cadb5c2cc5410b6c3395c8 Microchip EEPROM 24xx1025 is like a 24c1024. The only difference between them is that the I2C address bit used to select between the two banks is bit 2 for the 1025 and not bit 0 as in the 1024. Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru> Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl> 
Microchip EEPROM 24xx1025 is like a 24c1024. The only difference
between them is that the I2C address bit used to select between the
two banks is bit 2 for the 1025 and not bit 0 as in the 1024.

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Merge v5.15-rc5 into char-misc-next 2021-12-13T09:17:10+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2021-12-13T09:17:10+00:00 af40d16042d674442db8cf5fd654fabcd45fea44 We need the fixes in here as well, and also resolve some merge conflicts in: drivers/misc/eeprom/at25.c Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
We need the fixes in here as well, and also resolve some merge conflicts
in:
	drivers/misc/eeprom/at25.c

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
misc: at25: Align comment style 2021-12-03T13:26:15+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-11-25T21:32:03+00:00 1ca54ce9a3ff157b93402a7fea52595d029daa8d Make multi-line comment style aligned. While at it, drop filename from the file. Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211125213203.86693-11-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Make multi-line comment style aligned.
While at it, drop filename from the file.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211125213203.86693-11-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
misc: at25: Replace commas by spaces in the ID tables 2021-12-03T13:26:15+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-11-25T21:32:02+00:00 d6471ab9ab5814489ed2ebd8c554232b59ac571b For better readability replace commas by spaces in the ID tables. Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211125213203.86693-10-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
For better readability replace commas by spaces in the ID tables.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211125213203.86693-10-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
misc: at25: Reorganize headers for better maintenance 2021-12-03T13:26:15+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-11-25T21:32:01+00:00 d5fb1304acfd9b8077485c9fb1bf94c8218fd899 Split headers to three groups and sort alphabetically in each of them. Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211125213203.86693-9-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Split headers to three groups and sort alphabetically in each of them.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211125213203.86693-9-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
misc: at25: Factor out at_fram_to_chip() 2021-12-03T13:26:15+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-11-25T21:32:00+00:00 31a45d27c9328b9c8193f01d7d534659a03cee2d In the similar way as it's done for EEPROM, factor out a new helper function for FRAM. Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211125213203.86693-8-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
In the similar way as it's done for EEPROM, factor out
a new helper function for FRAM.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211125213203.86693-8-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
misc: at25: Switch to use BIT() instead of custom approaches 2021-12-03T13:26:15+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-11-25T21:31:59+00:00 d059ed1ba27bf0606471ac407008ddd1f65c4be4 It's obvious that custom approach of getting power of 2 number with int_pow() kinda interesting. Replace it and some others approaches by using a simple BIT() operation. Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211125213203.86693-7-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
It's obvious that custom approach of getting power of 2 number with
int_pow() kinda interesting. Replace it and some others approaches
by using a simple BIT() operation.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211125213203.86693-7-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>