diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-27 13:11:46 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-27 13:11:46 +0300 |
| commit | 519c523525b3e048862da1ab4ab4a878bdc01aab (patch) | |
| tree | dca8fa5b43bcd9c21ea05b643839e50af556545b /drivers/i2c/busses/i2c-tegra.c | |
| parent | 70139ad9eba06eec22aa4a03d6198dce7b1d7963 (diff) | |
| parent | 783cd2c3dca8b6c434e955b84c20c8940588dc68 (diff) | |
| download | linux-rolling-lts.tar.xz | |
Merge v6.12.35linux-rolling-lts
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/i2c/busses/i2c-tegra.c')
| -rw-r--r-- | drivers/i2c/busses/i2c-tegra.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c index 1df5b4204142..89ce8a62b37c 100644 --- a/drivers/i2c/busses/i2c-tegra.c +++ b/drivers/i2c/busses/i2c-tegra.c @@ -1395,6 +1395,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE); if (ret) break; + + /* Validate message length before proceeding */ + if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX) + break; + /* Set the msg length from first byte */ msgs[i].len += msgs[i].buf[0]; dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len); |