i2c: tegra: check msg length in SMBUS block read

jira LE-3622
Rebuild_History Non-Buildable kernel-6.12.0-55.22.1.el10_0
commit-author Akhil R <[email protected]>
commit a6e04f0

For SMBUS block read, do not continue to read if the message length
passed from the device is '0' or greater than the maximum allowed bytes.

	Signed-off-by: Akhil R <[email protected]>
	Acked-by: Thierry Reding <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Andi Shyti <[email protected]>
(cherry picked from commit a6e04f0)
	Signed-off-by: Jonathan Maple <[email protected]>

Author: PlaidCat

drivers/i2c/busses/i2c-tegra.c

@@ -1395,6 +1395,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 			ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE);
 			if (ret)
 				break;
+
+			/* Validate message length before proceeding */
+			if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX)
+				break;
+
 			/* Set the msg length from first byte */
 			msgs[i].len += msgs[i].buf[0];
 			dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len);