Re: [PATCH 0/2] Input: clamp SMBus block reads to the caller's buffer

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Hi Chengyu,

On Tue, Nov 03, 2026 at 09:11:25PM +0800, Chengyu Liu wrote:
> i2c_smbus_read_block_data() has no length parameter: it copies the
> device-reported byte count (clamped to I2C_SMBUS_BLOCK_MAX by the
> core) into the caller's buffer, so callers must pass a full-size
> buffer.  An audit of all call sites found two input drivers passing
> smaller stack buffers:
> 
>  - rmi4: rmi_read_pdt_entry() reads PDT entries into a 6-byte stack
>    buffer during PDT scanning at probe time; a device reporting a
>    count of 32 overruns it by 26 bytes.
> 
>  - cyapa: cyapa_gen3_irq_handler() reads into a 27-byte struct
>    cyapa_reg_data on every touch interrupt; a count of 32 overruns it
>    by 5 bytes, in interrupt context.
> 
> In both cases the contents are controlled by the device.  Bounce the
> reads through a full-size buffer and clamp the copy to the requested
> length.

No, we should be using the new 4-argument variant of 
i2c_smbus_read_block_data() that I posted earlier.

Thanks.

-- 
Dmitry