diff options
-rw-r--r-- | drivers/i2c/i2c-core-smbus.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c index 4bb9927afd01..a1082c04ac5c 100644 --- a/drivers/i2c/i2c-core-smbus.c +++ b/drivers/i2c/i2c-core-smbus.c | |||
@@ -397,16 +397,17 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, | |||
397 | the underlying bus driver */ | 397 | the underlying bus driver */ |
398 | break; | 398 | break; |
399 | case I2C_SMBUS_I2C_BLOCK_DATA: | 399 | case I2C_SMBUS_I2C_BLOCK_DATA: |
400 | if (data->block[0] > I2C_SMBUS_BLOCK_MAX) { | ||
401 | dev_err(&adapter->dev, "Invalid block %s size %d\n", | ||
402 | read_write == I2C_SMBUS_READ ? "read" : "write", | ||
403 | data->block[0]); | ||
404 | return -EINVAL; | ||
405 | } | ||
406 | |||
400 | if (read_write == I2C_SMBUS_READ) { | 407 | if (read_write == I2C_SMBUS_READ) { |
401 | msg[1].len = data->block[0]; | 408 | msg[1].len = data->block[0]; |
402 | } else { | 409 | } else { |
403 | msg[0].len = data->block[0] + 1; | 410 | msg[0].len = data->block[0] + 1; |
404 | if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) { | ||
405 | dev_err(&adapter->dev, | ||
406 | "Invalid block write size %d\n", | ||
407 | data->block[0]); | ||
408 | return -EINVAL; | ||
409 | } | ||
410 | for (i = 1; i <= data->block[0]; i++) | 411 | for (i = 1; i <= data->block[0]; i++) |
411 | msgbuf0[i] = data->block[i]; | 412 | msgbuf0[i] = data->block[i]; |
412 | } | 413 | } |