• Mans Rullgard's avatar
    i2c: core: check returned size of emulated smbus block read · 40e05200
    Mans Rullgard authored
    If the i2c bus driver ignores the I2C_M_RECV_LEN flag (as some of
    them do), it is possible for an I2C_SMBUS_BLOCK_DATA read issued
    on some random device to return an arbitrary value in the first
    byte (and nothing else).  When this happens, i2c_smbus_xfer_emulated()
    will happily write past the end of the supplied data buffer, thus
    causing Bad Things to happen.  To prevent this, check the size
    before copying the data block and return an error if it is too large.
    
    Fixes: 209d27c3 ("i2c: Emulate SMBus block read over I2C")
    Signed-off-by: default avatarMans Rullgard <mans@mansr.com>
    [wsa: use better errno]
    Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
    40e05200
i2c-core-smbus.c 20 KB