i2c: tegra: check msg length in SMBUS block read

JIRA: https://issues.redhat.com/browse/RHEL-89167

commit a6e04f0
Author: Akhil R <akhilrajeev@nvidia.com>
Date:   Thu Apr 24 11:03:20 2025 +0530

    i2c: tegra: check msg length in SMBUS block read

    For SMBUS block read, do not continue to read if the message length
    passed from the device is '0' or greater than the maximum allowed bytes.

    Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
    Acked-by: Thierry Reding <treding@nvidia.com>
    Link: https://lore.kernel.org/r/20250424053320.19211-1-akhilrajeev@nvidia.com
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>

(cherry picked from commit a6e04f0)
Signed-off-by: Steve Dunnagan <sdunnaga@redhat.com>

Author: Steve Dunnagan

drivers/i2c/busses/i2c-tegra.c

@@ -1397,6 +1397,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 			ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE);
 			if (ret)
 				break;
+
+			/* Validate message length before proceeding */
+			if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX)
+				break;
+
 			/* Set the msg length from first byte */
 			msgs[i].len += msgs[i].buf[0];
 			dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len);