tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

i2c: s3c24xx: check the size of the SMBUS message before using it

The first byte of an i2c SMBUS message is the size, and it should be
verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX
before processing it.

This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.

Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/2026022314-rely-scrubbed-4839@gregkh

authored by

Greg Kroah-Hartman and committed by
Andi Shyti c0128c71 d78908ea

+6 -1
+6 -1
drivers/i2c/busses/i2c-s3c2410.c
··· 503 503 i2c->msg->buf[i2c->msg_ptr++] = byte; 504 504 505 505 /* Add actual length to read for smbus block read */ 506 - if (i2c->msg->flags & I2C_M_RECV_LEN && i2c->msg->len == 1) 506 + if (i2c->msg->flags & I2C_M_RECV_LEN && i2c->msg->len == 1) { 507 + if (byte == 0 || byte > I2C_SMBUS_BLOCK_MAX) { 508 + s3c24xx_i2c_stop(i2c, -EPROTO); 509 + break; 510 + } 507 511 i2c->msg->len += byte; 512 + } 508 513 prepare_read: 509 514 if (is_msglast(i2c)) { 510 515 /* last byte of buffer */