Commit a6e04f05 authored by Akhil R's avatar Akhil R Committed by Andi Shyti
Browse files

i2c: tegra: check msg length in SMBUS block read 



For SMBUS block read, do not continue to read if the message length
passed from the device is '0' or greater than the maximum allowed bytes.

Signed-off-by: default avatarAkhil R <akhilrajeev@nvidia.com>
Acked-by: default avatarThierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20250424053320.19211-1-akhilrajeev@nvidia.com


Signed-off-by: default avatarAndi Shyti <andi.shyti@kernel.org>
parent 090c3a4a

drivers/i2c/busses/i2c-tegra.c

+5 −0
Original line number Diff line number Diff line
@@ -1395,6 +1395,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], 
			ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE);

			if (ret)

				break;



			/* Validate message length before proceeding */

			if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX)

				break;



			/* Set the msg length from first byte */

			msgs[i].len += msgs[i].buf[0];

			dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len);