[PATCH v2] media: go7007: bound EZ-USB I2C transfers to the usb_buf size

[Shengzhuo Wei]

go7007_usb_i2c_master_xfer() copies msgs[i].len bytes into go->usb_buf,
a 16-byte buffer embedded in struct go7007, without any length check.
The adapter declares no transfer limits, so an SMBus block transfer
issued through /dev/i2c-N can write up to 34 bytes into it and corrupt
the struct fields that follow the buffer.

Bound the transfer size with i2c_adapter_quirks so the I2C core
rejects oversized messages before they reach the driver.

Fixes: 7955f03d18d1 ("[media] go7007: move out of staging into drivers/media/usb.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
Assisted-by: GLM:5.3
---
The EZ-USB I2C adapter in the go7007 driver copies message payloads
into the 16-byte usb_buf embedded in the go7007 device struct without
any length limit, so an SMBus block transfer through /dev/i2c-N can
write past the buffer and corrupt the struct fields that follow it.
Bound the transfer size through i2c_adapter_quirks.
---
Changes in v2:
- Drop the Cc: tag for the maintainer from the commit message; the
  recipient is already covered by the Cc email header.
- Link to v1: https://patch.msgid.link/20260827-go7007-i2c-buf-bound-v1-1-4555cc3d0464@xxxxxxxx
---
 drivers/media/usb/go7007/go7007-usb.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index c0cb92fa6ab9..867548d655b3 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1029,10 +1029,16 @@ static const struct i2c_algorithm go7007_usb_algo = {
 	.functionality	= go7007_usb_functionality,
 };
 
+static const struct i2c_adapter_quirks go7007_usb_quirks = {
+	.max_write_len	= 12,
+	.max_read_len	= 15,
+};
+
 static struct i2c_adapter go7007_usb_adap_templ = {
 	.owner			= THIS_MODULE,
 	.name			= "WIS GO7007SB EZ-USB",
 	.algo			= &go7007_usb_algo,
+	.quirks			= &go7007_usb_quirks,
 };
 
 /********************* USB add/remove functions *********************/

---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260827-go7007-i2c-buf-bound-d4fbe42a4a79

Best regards,
--  
Shengzhuo Wei <me@xxxxxxxx>