Hi maintainers,
Please consider backporting the following patches to the stable trees. These patches fix a significant reading issue with mcp2221 on i2c eeprom. This request is following the one I did previously to fix hid-mcp2221 in previous LTS versions.
I have confirmed that the patches applie cleanly and build successfully against v6.12, v6.6, v6.1, v5.15 and v5.10 stable branches.
Thanks,
Romain
Arnaud Lecomte (1): hid: fix I2C read buffer overflow in raw_event() for mcp2221
drivers/hid/hid-mcp2221.c | 4 ++++ 1 file changed, 4 insertions(+)
From: Arnaud Lecomte contact@arnaud-lcm.com
[ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte contact@arnaud-lcm.com Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires bentiss@kernel.org [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag] Signed-off-by: Romain Sioen romain.sioen@microchip.com --- drivers/hid/hid-mcp2221.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c index 0f93c22a479f..83941b916cd6 100644 --- a/drivers/hid/hid-mcp2221.c +++ b/drivers/hid/hid-mcp2221.c @@ -814,6 +814,10 @@ static int mcp2221_raw_event(struct hid_device *hdev, } if (data[2] == MCP2221_I2C_READ_COMPL || data[2] == MCP2221_I2C_READ_PARTIAL) { + if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) { + mcp->status = -EINVAL; + break; + } buf = mcp->rxbuf; memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]); mcp->rxbuf_idx = mcp->rxbuf_idx + data[3];
On Tue, Oct 07, 2025 at 03:08:11PM +0200, Romain Sioen wrote:
From: Arnaud Lecomte contact@arnaud-lcm.com
[ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte contact@arnaud-lcm.com Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires bentiss@kernel.org [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag]
I don't see a fixes tag :(
And is this only for 6.12 and 6.16?
thanks,
greg k-h
On 07/10/2025 15:16, Greg KH wrote:
On Tue, Oct 07, 2025 at 03:08:11PM +0200, Romain Sioen wrote:
From: Arnaud Lecomte contact@arnaud-lcm.com
[ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte contact@arnaud-lcm.com Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires bentiss@kernel.org [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag]
I don't see a fixes tag :(
Hey, I am the author of the patch. I can find the fixes tag if this looks good to you. Thanks,
Arnaud
And is this only for 6.12 and 6.16?
thanks,
greg k-h
On Tue, Oct 07, 2025 at 05:23:17PM +0200, Lecomte, Arnaud wrote:
On 07/10/2025 15:16, Greg KH wrote:
On Tue, Oct 07, 2025 at 03:08:11PM +0200, Romain Sioen wrote:
From: Arnaud Lecomte contact@arnaud-lcm.com
[ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte contact@arnaud-lcm.com Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires bentiss@kernel.org [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag]
I don't see a fixes tag :(
Hey, I am the author of the patch. I can find the fixes tag if this looks good to you.
There's no need for a fixes tag, just let us know where you want this backported to.
thanks,
greg k-h
On 07/10/2025 17:26, Greg KH wrote:
On Tue, Oct 07, 2025 at 05:23:17PM +0200, Lecomte, Arnaud wrote:
On 07/10/2025 15:16, Greg KH wrote:
On Tue, Oct 07, 2025 at 03:08:11PM +0200, Romain Sioen wrote:
From: Arnaud Lecomte contact@arnaud-lcm.com
[ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte contact@arnaud-lcm.com Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires bentiss@kernel.org [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag]
I don't see a fixes tag :(
Hey, I am the author of the patch. I can find the fixes tag if this looks good to you.
There's no need for a fixes tag, just let us know where you want this backported to.
The ones, you already did the back-port to, seems good enough for me, Thanks Greg :)
thanks,
greg k-h
Arnaud
Hi all,
On 10/8/25 8:50 AM, "Lecomte, Arnaud" contact@arnaud-lcm.com wrote:
EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
On 07/10/2025 17:26, Greg KH wrote:
On Tue, Oct 07, 2025 at 05:23:17PM +0200, Lecomte, Arnaud wrote:
On 07/10/2025 15:16, Greg KH wrote:
On Tue, Oct 07, 2025 at 03:08:11PM +0200, Romain Sioen wrote:
From: Arnaud Lecomte contact@arnaud-lcm.com
[ Upstream commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 ]
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte contact@arnaud-lcm.com Link: https://patch.msgid.link/20250726220931.7126-1- contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires bentiss@kernel.org [romain.sioen@microchip.com: backport to stable, up to 6.12. Add "Fixes" tag]
I don't see a fixes tag :(
Hey, I am the author of the patch. I can find the fixes tag if this looks good to you.
There's no need for a fixes tag, just let us know where you want this backported to.
The ones, you already did the back-port to, seems good enough for me, Thanks Greg :)
thanks,
greg k-h
Arnaud
Sorry for the confusion, I didn't put a tag indeed. I just wanted to backport this patch to previous LTS versions 5.10, 5.15, 6.1, 6.6 and 6.12 as we need it to solve a bug. I tested it in all these stable versions and can confirm that it compiles correctly. This is in the continuity of a backport request I made 1 month ago which has been accepted and merged.
Thank you for your help,
Romain
linux-stable-mirror@lists.linaro.org
-
Greg KH -
Greg KH -
Lecomte, Arnaud -
Romain Sioen -
romain.sioen＠microchip.com