[PATCH] i2c: busses: Fix out-of-bounds bug in mchp_corei2c_smbus_xfer

[Andi Shyti]

Hi Wolfram,

On Sat, Jun 28, 2025 at 10:09:48PM +0200, Wolfram Sang wrote:
> On Sun, Jun 15, 2025 at 07:49:19PM -0400, Alex Guo wrote:
> > The data->block[0] variable comes from user. Without proper check,
> > the variable may be very large to cause an out-of-bounds bug.
> 
> Okay, okay, instead of adding these limits to all these drivers, let me
> start adding SMBus3 support to the kernel which allows for bigger block
> sizes. I probably won't have time to export this to user space yet, but
> let's at least make sure the kernel, and thus the drivers, won't suffer
> from buffer overflows anymore.

in the meantime, what should i do with all these patches? They
are not wrong and I agree that we need to work on the i2c core.
Besides having something like this might help all those drivers
using i2c by removing the need for their own specific
i2c_read/write methods.

Some times ago I started working on this and I have it still
laying around in one of my branches. If you haven'd done much
progress, i can bring it to life.

Andi