[PATCH 1/3] hwmon: (pt5161l) Fix undersized buffer for i2c_smbus_read_block_data()

[Pradhan, Sanman]

From: Sanman Pradhan <psanman@xxxxxxxxxxx>

pt5161l_read_block_data() declares a local buffer as u8 rbuf[24] and
passes it to i2c_smbus_read_block_data(). The SMBus block read
protocol permits a device to return up to I2C_SMBUS_BLOCK_MAX (32)
data bytes. The i2c-core helper copies the returned data bytes
into the caller's buffer before the return value can be checked, so
the post-read validation `if (ret == curr_len)` does not prevent a
potential overrun if a device returns more than 24 bytes.

Resize the buffer to I2C_SMBUS_BLOCK_MAX to cover the maximum SMBus
block read payload.

Fixes: 1b2ca93cd0592 ("hwmon: Add driver for Astera Labs PT5161L retimer")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Sanman Pradhan <psanman@xxxxxxxxxxx>
---
 drivers/hwmon/pt5161l.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/pt5161l.c b/drivers/hwmon/pt5161l.c
index 20e3cfa625f17..9c450bcb9dd8c 100644
--- a/drivers/hwmon/pt5161l.c
+++ b/drivers/hwmon/pt5161l.c
@@ -121,7 +121,7 @@ static int pt5161l_read_block_data(struct pt5161l_data *data, u32 address,
 	int ret, tries;
 	u8 remain_len = len;
 	u8 curr_len;
-	u8 wbuf[16], rbuf[24];
+	u8 wbuf[16], rbuf[I2C_SMBUS_BLOCK_MAX];
 	u8 cmd = 0x08; /* [7]:pec_en, [4:2]:func, [1]:start, [0]:end */
 	u8 config = 0x00; /* [6]:cfg_type, [4:1]:burst_len, [0]:address bit16 */
 
-- 
2.34.1