hc
2024-10-12 a5969cabbb4660eab42b6ef0412cbbd1200cf14d
kernel/drivers/i2c/busses/i2c-ismt.c
....@@ -507,6 +507,9 @@
507507 if (read_write == I2C_SMBUS_WRITE) {
508508 /* Block Write */
509509 dev_dbg(dev, "I2C_SMBUS_BLOCK_DATA: WRITE\n");
510
+ if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX)
511
+ return -EINVAL;
512
+
510513 dma_size = data->block[0] + 1;
511514 dma_direction = DMA_TO_DEVICE;
512515 desc->wr_len_cmd = dma_size;