[PATCH linux dev-4.{7, 10} v2] i2c-core: Expand buffers used in i2c_smbus_xfer_emulated()

[Joel Stanley]

On Tue, Mar 14, 2017 at 7:50 PM, Andrew Jeffery <andrew at aj.id.au> wrote:

>                 switch (size) {
>                 case I2C_SMBUS_BYTE:
>                         data->byte = msgbuf0[0];
> @@ -3056,11 +3079,26 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
>                         break;
>                 case I2C_SMBUS_BLOCK_DATA:
>                 case I2C_SMBUS_BLOCK_PROC_CALL:
> -                       for (i = 0; i < msgbuf1[0] + 1; i++)
> +                       recvd = msgbuf1[0] + 1;
> +
> +                       if (recvd > sizeof(*data)) {
> +                               dev_warn(&adapter->dev,
> +                                               "SMBus block operation received invalid payload length of %zu\n",
> +                                               recvd);
> +                               return -EIO;

The maiden voyage of Leaky McLeakface.

I changed this to:

ret = -EIO;
goto out;

Aside from your aversion to vowels this looks good to me. Applied to dev-4.7.

I think you should send this upstream. You could send it with just
this snippet, without the dynamic memory allocation. Or the entire
thing.

Cheers,

Joel


> +                       }
> +
> +                       for (i = 0; i < recvd; i++)
>                                 data->block[i] = msgbuf1[i];
> +
>                         break;
>                 }
> -       return 0;
> +       }
> +out:
> +       kfree(msgbuf0);
> +       kfree(msgbuf1);
> +
> +       return ret;
>  }
>
>  /**
> --
> 2.9.3
>