]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
i2c: s3c24xx: check the size of the SMBUS message before using it
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 23 Feb 2026 17:05:15 +0000 (18:05 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Apr 2026 11:32:15 +0000 (13:32 +0200)
commitaaaaec39ddbcd06770dca7f1adebc3b1242ebe7b
tree8e1d472a4b2ed0d8f87fd4f505e7628475fe989d
parent34c1741254ff972e8375faf176678a248826fe3a
i2c: s3c24xx: check the size of the SMBUS message before using it

commit c0128c7157d639a931353ea344fb44aad6d6e17a upstream.

The first byte of an i2c SMBUS message is the size, and it should be
verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX
before processing it.

This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.

Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/2026022314-rely-scrubbed-4839@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/i2c/busses/i2c-s3c2410.c