kernel_optimize_test/drivers
Jean Delvare 9ab1ee2ab7 [PATCH] I2C: New max6875 driver may corrupt EEPROMs
After a careful code analysis on the new max6875 driver
(drivers/i2c/chips/max6875.c), I have come to the conclusion that this
driver may cause EEPROM corruptions if used on random systems.

The EEPROM part of the MAX6875 chip is accessed using rather uncommon
I2C sequences. What is seen by the MAX6875 as reads can be seen by a
standard EEPROM (24C02) as writes. If you check the detection method
used by the driver, you'll find that the first SMBus command it will
send on the bus is i2c_smbus_write_byte_data(client, 0x80, 0x40). For
the MAX6875 it makes an internal pointer point to a specific offset of
the EEPROM waiting for a subsequent read command, so it's not an actual
data write operation, but for a standard EEPROM, this instead means
writing value 0x40 to offset 0x80. Blame Philips and Intel for the
obscure protocol.

Since the MAX6875 and the standard, common 24C02 EEPROMs share two I2C
addresses (0x50 and 0x52), loading the max6875 driver on a system with
standard EEPROMs at either address will trigger a write on these
EEPROMs, which will lead to their corruption if they happen not to be
write protected. This kind of EEPROMs can be found on memory modules
(SPD), ethernet adapters (MAC address), laptops (proprietary data) and
displays (EDID/DDC). Most of these are hopefully write-protected, but
not all of them.

For this reason, I would recommend that the max6875 driver be
neutralized, in a way that nobody can corrupt his/her EEPROMs by just
loading the driver. This means either deleting the driver completely, or
not listing any default address for it. I'd like this to be done before
2.6.13-rc1 is released.

Additionally, the max6875 driver lacks the 24RF08 corruption preventer
present in the eeprom driver, which means that loading this driver in a
system with such a chip would corrupt it as well.

Here is a proposed quick patch addressing the issue, although I wouldn't
mind a complete removal if it makes everyone feel safer. I think Ben
has plans to replace this driver by a much simplified one anyway.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-07-11 14:10:36 -07:00
..
acorn
acpi If ACPI doesn't find an irq listed, don't accept 0 as a valid PCI irq. 2005-07-02 10:35:33 -07:00
atm
base [PATCH] Driver core: Use klist_del() instead of klist_remove(). 2005-06-29 22:48:05 -07:00
block [PATCH] Fix get_request nastiness 2005-06-29 08:46:30 -07:00
bluetooth [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
cdrom [PATCH] drivers/cdrom/cm206.c: cleanups 2005-06-25 16:25:07 -07:00
char drm: fix stupid missing semicolon. 2005-07-10 12:46:19 +10:00
cpufreq [PATCH] pm: fix u32 vs. pm_message_t confusion in cpufreq 2005-07-07 18:23:43 -07:00
crypto [CRYPTO] Update IV correctly for Padlock CBC encryption 2005-07-06 13:54:09 -07:00
dio
eisa
fc4
firmware [IA64-SGI] pcdp: add PCDP pci interface support 2005-06-28 09:09:06 -07:00
i2c [PATCH] I2C: New max6875 driver may corrupt EEPROMs 2005-07-11 14:10:36 -07:00
ide [PATCH] pcmcia: remove references to pcmcia/version.h 2005-07-07 18:24:07 -07:00
ieee1394 [PATCH] Sync up ieee-1394 2005-07-10 12:23:23 -07:00
infiniband [PATCH] IB uverbs: add mthca user QP support 2005-07-07 18:23:50 -07:00
input [PATCH] x86: i8253/i8259A lock cleanup 2005-06-30 08:45:10 -07:00
isdn [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
macintosh [PATCH] openfirmware: implement hotplug for macio devices 2005-07-06 12:55:20 -07:00
mca [PATCH] unexport mca_find_device_by_slot 2005-06-25 16:24:56 -07:00
md [PATCH] device-mapper: dm-raid1: Limit bios to size of mirror region 2005-07-07 18:24:11 -07:00
media [PATCH] v4l: LGDT3302 read status fix 2005-07-07 18:24:04 -07:00
message [PATCH] pm: more u32 vs. pm_message_t fixes 2005-07-07 18:23:43 -07:00
misc
mmc [PATCH] MMC: wbsd cleanups 2005-07-01 13:07:37 +01:00
mtd Merge master.kernel.org:/pub/scm/linux/kernel/git/tglx/mtd-2.6 2005-07-11 10:18:18 -07:00
net [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
nubus
oprofile [PATCH] oprofile: report anonymous region samples 2005-06-24 00:06:27 -07:00
parisc [PATCH] acpi bridge hotadd: ACPI based root bridge hot-add 2005-06-27 21:52:39 -07:00
parport [PATCH] pcmcia: remove references to pcmcia/version.h 2005-07-07 18:24:07 -07:00
pci [PATCH] pm: more u32 vs. pm_message_t fixes 2005-07-07 18:23:43 -07:00
pcmcia [PATCH] yenta: don't depend on CardBus 2005-07-07 18:24:07 -07:00
pnp [PATCH] Cleanup patch for process freezing 2005-06-25 17:10:13 -07:00
s390 [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
sbus [SPARC]: bpp: remove sleep_on usage 2005-07-04 13:24:14 -07:00
scsi [PATCH] pcmcia: remove references to pcmcia/version.h 2005-07-07 18:24:07 -07:00
serial [PATCH] pcmcia: remove references to pcmcia/version.h 2005-07-07 18:24:07 -07:00
sh
sn
tc
telephony [PATCH] pcmcia: remove references to pcmcia/version.h 2005-07-07 18:24:07 -07:00
usb [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
video [PATCH] m32r: framebuffer device support 2005-07-07 18:24:11 -07:00
w1 [PATCH] Cleanup patch for process freezing 2005-06-25 17:10:13 -07:00
zorro
Kconfig
Makefile