i2c: at91: add bound checking on SMBus block length bytes
authorMarek Roszko <mark.roszko@gmail.com>
Thu, 21 Aug 2014 01:39:41 +0000 (21:39 -0400)
committerWolfram Sang <wsa@the-dreams.de>
Tue, 2 Sep 2014 12:29:33 +0000 (14:29 +0200)
commit75b81f339c6af43f6f4a1b3eabe0603321dade65
treec3fe33ee41b403ca194c82a14c76652e19038145
parent5da4309f9e1b4de9c2b69e917912fbb84006d44e
i2c: at91: add bound checking on SMBus block length bytes

The driver was not bound checking the received length byte to ensure it was within the
the buffer size that is allocated for SMBus blocks. This resulted in buffer overflows
whenever an invalid length byte was received.
It also failed to ensure the length byte was not zero. If it received zero, it would end up
in an infinite loop as the at91_twi_read_next_byte function returned immediately without
allowing RHR to be read to clear the RXRDY interrupt.

Tested agaisnt a SMBus compliant battery.

Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
drivers/i2c/busses/i2c-at91.c