[PATCH 00/31] hwmon: convert i2c_smbus_read_block_data() users to pass buffer length

[PATCH 00/31] hwmon: convert i2c_smbus_read_block_data() users to pass buffer length

[Dmitry Torokhov]

Convert all callers of i2c_smbus_read_block_data() across the hwmon
and PMBus subsystems to pass destination buffer sizes, adopting the
4-argument form introduced in commit 68f382641f8c ("i2c: smbus: make
i2c_smbus_read_block_data() safer").

For drivers that used intermediate bounce buffers (lineage-pem, lm93,
and pt5161l), redundant buffer allocations and memcpy() calls are
dropped so data is read directly into target structures.

For drivers performing string comparisons on the read data
(acbel-fsg032, bpa-rs600, ltc4286, max15301, pim4328, and stpddc60),
ensure the destination buffer is explicitly NUL-terminated before
comparison, and pass a length that reserves space for the terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
Dmitry Torokhov (31):
      hwmon: (lineage-pem) use 4-argument i2c_smbus_read_block_data()
      hwmon: (lm93) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pt5161l) use 4-argument i2c_smbus_read_block_data()
      hwmon: (kb9002) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/acbel-fsg032) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/adm1266) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/aps-379) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/bpa-rs600) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/crps) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/d1u74t) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/dps920ab) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/fsp-3y) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/ibm-cffps) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/inspur-ipsps) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/ir35221) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/lt7182s) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/ltc4286) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/lx1308) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/max15301) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/max16601) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/max20730) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/mp5920) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/pim4328) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/pxe1610) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/q54sj108a2) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/stpddc60) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/tps53679) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/ucd9000) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/ucd9200) use 4-argument i2c_smbus_read_block_data()
      hwmon: (pmbus/zl6100) use 4-argument i2c_smbus_read_block_data()

 drivers/hwmon/kb9002.c             |  6 ++++--
 drivers/hwmon/lineage-pem.c        | 17 ++++++-----------
 drivers/hwmon/lm93.c               | 12 ++----------
 drivers/hwmon/pmbus/acbel-fsg032.c | 16 +++++++++-------
 drivers/hwmon/pmbus/adm1266.c      | 25 ++++++++++++++++---------
 drivers/hwmon/pmbus/aps-379.c      |  3 ++-
 drivers/hwmon/pmbus/bpa-rs600.c    |  5 +++--
 drivers/hwmon/pmbus/crps.c         |  5 +++--
 drivers/hwmon/pmbus/d1u74t.c       |  8 +++++---
 drivers/hwmon/pmbus/dps920ab.c     |  6 ++++--
 drivers/hwmon/pmbus/fsp-3y.c       |  3 ++-
 drivers/hwmon/pmbus/ibm-cffps.c    |  5 +++--
 drivers/hwmon/pmbus/inspur-ipsps.c |  4 ++--
 drivers/hwmon/pmbus/ir35221.c      |  6 ++++--
 drivers/hwmon/pmbus/lt7182s.c      |  6 ++++--
 drivers/hwmon/pmbus/ltc4286.c      |  8 ++++++--
 drivers/hwmon/pmbus/lx1308.c       |  9 ++++++---
 drivers/hwmon/pmbus/max15301.c     |  4 +++-
 drivers/hwmon/pmbus/max16601.c     |  7 ++++---
 drivers/hwmon/pmbus/max20730.c     |  9 ++++++---
 drivers/hwmon/pmbus/mp5920.c       |  3 ++-
 drivers/hwmon/pmbus/pim4328.c      |  4 +++-
 drivers/hwmon/pmbus/pmbus_core.c   |  3 ++-
 drivers/hwmon/pmbus/pxe1610.c      |  2 +-
 drivers/hwmon/pmbus/q54sj108a2.c   | 27 ++++++++++++++++++---------
 drivers/hwmon/pmbus/stpddc60.c     |  4 +++-
 drivers/hwmon/pmbus/tps53679.c     |  9 ++++++---
 drivers/hwmon/pmbus/ucd9000.c      |  8 +++++---
 drivers/hwmon/pmbus/ucd9200.c      |  4 ++--
 drivers/hwmon/pmbus/zl6100.c       |  2 +-
 drivers/hwmon/pt5161l.c            |  5 ++---
 31 files changed, 139 insertions(+), 96 deletions(-)
---
base-commit: 20a33c6b6cbe7e4805dfb6cd68816937443aa148
change-id: 20261022-hwmon-i2c-smbus-read-block-data-554b91958a09

Thanks.

-- 
Dmitry

[PATCH 01/31] hwmon: (lineage-pem) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the expected data length and destination buffer directly to
i2c_smbus_read_block_data() instead of copying through an intermediate
buffer.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/lineage-pem.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/drivers/hwmon/lineage-pem.c b/drivers/hwmon/lineage-pem.c
index 2553e49f8401..75a44b0639dc 100644
--- a/drivers/hwmon/lineage-pem.c
+++ b/drivers/hwmon/lineage-pem.c
@@ -130,20 +130,15 @@ struct pem_data {
 static int pem_read_block(struct i2c_client *client, u8 command, u8 *data,
 			  int data_len)
 {
-	u8 block_buffer[I2C_SMBUS_BLOCK_MAX];
 	int result;
 
-	result = i2c_smbus_read_block_data(client, command, block_buffer);
+	result = i2c_smbus_read_block_data(client, command, data_len, data);
 	if (unlikely(result < 0))
-		goto abort;
-	if (unlikely(result == 0xff || result != data_len)) {
-		result = -EIO;
-		goto abort;
-	}
-	memcpy(data, block_buffer, data_len);
-	result = 0;
-abort:
-	return result;
+		return result;
+	if (unlikely(result == 0xff || result != data_len))
+		return -EIO;
+
+	return 0;
 }
 
 static struct pem_data *pem_update_device(struct device *dev)

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 02/31] hwmon: (lm93) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the expected command length and destination buffer directly to
i2c_smbus_read_block_data() instead of using a static intermediate
buffer and memcpy.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/lm93.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/hwmon/lm93.c b/drivers/hwmon/lm93.c
index d58a3c2a8593..2cbf0af22f61 100644
--- a/drivers/hwmon/lm93.c
+++ b/drivers/hwmon/lm93.c
@@ -871,8 +871,6 @@ static int lm93_write_word(struct i2c_client *client, u8 reg, u16 value)
 	return result;
 }
 
-static u8 lm93_block_buffer[I2C_SMBUS_BLOCK_MAX];
-
 /*
  * read block data into values, retry if not expected length
  * fbn => index to lm93_block_read_cmds table
@@ -884,7 +882,8 @@ static void lm93_read_block(struct i2c_client *client, u8 fbn, u8 *values)
 
 	for (i = 1; i <= MAX_RETRIES; i++) {
 		result = i2c_smbus_read_block_data(client,
-			lm93_block_read_cmds[fbn].cmd, lm93_block_buffer);
+			lm93_block_read_cmds[fbn].cmd,
+			lm93_block_read_cmds[fbn].len, values);
 
 		if (result == lm93_block_read_cmds[fbn].len) {
 			break;
@@ -895,13 +894,6 @@ static void lm93_read_block(struct i2c_client *client, u8 fbn, u8 *values)
 			mdelay(i + 3);
 		}
 	}
-
-	if (result == lm93_block_read_cmds[fbn].len) {
-		memcpy(values, lm93_block_buffer,
-		       lm93_block_read_cmds[fbn].len);
-	} else {
-		/* <TODO> what to do in case of error? */
-	}
 }
 
 static struct lm93_data *lm93_update_device(struct device *dev)

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 03/31] hwmon: (pt5161l) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the chunk length and destination buffer directly to
i2c_smbus_read_block_data() instead of copying through an intermediate
buffer.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pt5161l.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pt5161l.c b/drivers/hwmon/pt5161l.c
index 1638f54f8eae..b38b1f63627a 100644
--- a/drivers/hwmon/pt5161l.c
+++ b/drivers/hwmon/pt5161l.c
@@ -121,7 +121,7 @@ static int pt5161l_read_block_data(struct pt5161l_data *data, u32 address,
 	int ret, tries;
 	u8 remain_len = len;
 	u8 curr_len;
-	u8 wbuf[16], rbuf[I2C_SMBUS_BLOCK_MAX];
+	u8 wbuf[16];
 	u8 cmd = 0x08; /* [7]:pec_en, [4:2]:func, [1]:start, [0]:end */
 	u8 config = 0x00; /* [6]:cfg_type, [4:1]:burst_len, [0]:address bit16 */
 
@@ -146,14 +146,13 @@ static int pt5161l_read_block_data(struct pt5161l_data *data, u32 address,
 				return ret;
 
 			ret = i2c_smbus_read_block_data(client, (cmd | 0x1),
-							rbuf);
+							curr_len, val);
 			if (ret == curr_len)
 				break;
 		}
 		if (tries >= 3)
 			return ret < 0 ? ret : -EIO;
 
-		memcpy(val, rbuf, curr_len);
 		val += curr_len;
 		address += curr_len;
 	}

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 04/31] hwmon: (kb9002) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the size of the receive buffer to i2c_smbus_read_block_data() in
kb9002_fw_read() and kb9002_smbus_hw_read().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/kb9002.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/kb9002.c b/drivers/hwmon/kb9002.c
index 9f4521630f3a..01dedc00c3f1 100644
--- a/drivers/hwmon/kb9002.c
+++ b/drivers/hwmon/kb9002.c
@@ -183,7 +183,8 @@ static int kb9002_fw_read(struct kb9002_data *data, u16 reg, u32 *val)
 	if (ret < 0)
 		return ret;
 
-	ret = i2c_smbus_read_block_data(client, KB9002_CC_FW_READ_DATA, rbuf);
+	ret = i2c_smbus_read_block_data(client, KB9002_CC_FW_READ_DATA,
+					sizeof(rbuf), rbuf);
 	if (ret < 0)
 		return ret;
 	if (ret < (int)(sizeof(addr) + sizeof(*val)))
@@ -208,7 +209,8 @@ static int kb9002_smbus_hw_read(struct kb9002_data *data, u32 reg, u32 *val)
 	if (ret < 0)
 		return ret;
 
-	ret = i2c_smbus_read_block_data(client, KB9002_CC_HW_READ_DATA, rbuf);
+	ret = i2c_smbus_read_block_data(client, KB9002_CC_HW_READ_DATA,
+					sizeof(rbuf), rbuf);
 	if (ret < 0)
 		return ret;
 	if (ret < (int)(sizeof(addr) + sizeof(*val)))

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 05/31] hwmon: (pmbus/acbel-fsg032) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data(), shrink the
debugfs data buffer to I2C_SMBUS_BLOCK_MAX, and ensure the string
buffer is NUL-terminated before comparison.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/acbel-fsg032.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/hwmon/pmbus/acbel-fsg032.c b/drivers/hwmon/pmbus/acbel-fsg032.c
index 5222e7aeca44..d36076b9c44d 100644
--- a/drivers/hwmon/pmbus/acbel-fsg032.c
+++ b/drivers/hwmon/pmbus/acbel-fsg032.c
@@ -19,11 +19,12 @@ static ssize_t acbel_fsg032_debugfs_read(struct file *file, char __user *buf, si
 					 loff_t *ppos)
 {
 	struct i2c_client *client = file->private_data;
-	u8 data[I2C_SMBUS_BLOCK_MAX + 2] = { 0 };
+	u8 data[I2C_SMBUS_BLOCK_MAX] = { 0 };
 	char out[8];
 	int rc;
 
-	rc = i2c_smbus_read_block_data(client, ACBEL_MFR_FW_REVISION, data);
+	rc = i2c_smbus_read_block_data(client, ACBEL_MFR_FW_REVISION,
+				       sizeof(data), data);
 	if (rc < 0)
 		return rc;
 
@@ -70,25 +71,26 @@ static int acbel_fsg032_probe(struct i2c_client *client)
 	struct device *dev = &client->dev;
 	int rc;
 
-	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+				       sizeof(buf) - 1, buf);
 	if (rc < 0) {
 		dev_err(dev, "Failed to read PMBUS_MFR_ID\n");
 		return rc;
 	}
+	buf[rc] = '\0';
 	if (strncmp(buf, "ACBEL", 5)) {
-		buf[rc] = '\0';
 		dev_err(dev, "Manufacturer '%s' not supported\n", buf);
 		return -ENODEV;
 	}
 
-	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+				       sizeof(buf) - 1, buf);
 	if (rc < 0) {
 		dev_err(dev, "Failed to read PMBUS_MFR_MODEL\n");
 		return rc;
 	}
-
+	buf[rc] = '\0';
 	if (strncmp(buf, "FSG032", 6)) {
-		buf[rc] = '\0';
 		dev_err(dev, "Model '%s' not supported\n", buf);
 		return -ENODEV;
 	}

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 06/31] hwmon: (pmbus/adm1266) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data() and shrink the
GPIO read buffers to I2C_SMBUS_BLOCK_MAX since they contain raw binary
status bytes and are not NUL-terminated.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/adm1266.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/hwmon/pmbus/adm1266.c b/drivers/hwmon/pmbus/adm1266.c
index 22ccb721dd51..9f3b5bc9f3e2 100644
--- a/drivers/hwmon/pmbus/adm1266.c
+++ b/drivers/hwmon/pmbus/adm1266.c
@@ -165,7 +165,7 @@ static const char *adm1266_names[ADM1266_GPIO_NR + ADM1266_PDIO_NR] = {
 static int adm1266_gpio_get(struct gpio_chip *chip, unsigned int offset)
 {
 	struct adm1266_data *data = gpiochip_get_data(chip);
-	u8 read_buf[I2C_SMBUS_BLOCK_MAX + 1];
+	u8 read_buf[I2C_SMBUS_BLOCK_MAX];
 	unsigned long pins_status;
 	unsigned int pmbus_cmd;
 	int ret;
@@ -177,7 +177,8 @@ static int adm1266_gpio_get(struct gpio_chip *chip, unsigned int offset)
 
 	guard(pmbus_lock)(data->client);
 
-	ret = i2c_smbus_read_block_data(data->client, pmbus_cmd, read_buf);
+	ret = i2c_smbus_read_block_data(data->client, pmbus_cmd,
+					sizeof(read_buf), read_buf);
 	if (ret < 0)
 		return ret;
 	if (ret < 2)
@@ -194,14 +195,15 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask
 				     unsigned long *bits)
 {
 	struct adm1266_data *data = gpiochip_get_data(chip);
-	u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1];
+	u8 read_buf[I2C_SMBUS_BLOCK_MAX];
 	unsigned long status;
 	unsigned int gpio_nr;
 	int ret;
 
 	guard(pmbus_lock)(data->client);
 
-	ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS, read_buf);
+	ret = i2c_smbus_read_block_data(data->client, ADM1266_GPIO_STATUS,
+					sizeof(read_buf), read_buf);
 	if (ret < 0)
 		return ret;
 	if (ret < 2)
@@ -215,7 +217,8 @@ static int adm1266_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask
 			set_bit(gpio_nr, bits);
 	}
 
-	ret = i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, read_buf);
+	ret = i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS,
+					sizeof(read_buf), read_buf);
 	if (ret < 0)
 		return ret;
 	if (ret < 2)
@@ -361,7 +364,8 @@ static int adm1266_firmware_revision_read(struct seq_file *s, void *pdata)
 	int ret;
 
 	guard(pmbus_lock)(client);
-	ret = i2c_smbus_read_block_data(client, ADM1266_IC_DEVICE_REV, buf);
+	ret = i2c_smbus_read_block_data(client, ADM1266_IC_DEVICE_REV,
+					sizeof(buf), buf);
 	if (ret < 0)
 		return ret;
 	if (ret < 3)
@@ -387,7 +391,8 @@ static int adm1266_powerup_counter_read(struct seq_file *s, void *pdata)
 	int ret;
 
 	guard(pmbus_lock)(client);
-	ret = i2c_smbus_read_block_data(client, ADM1266_POWERUP_COUNTER, buf);
+	ret = i2c_smbus_read_block_data(client, ADM1266_POWERUP_COUNTER,
+					sizeof(buf), buf);
 	if (ret < 0)
 		return ret;
 	if (ret != 2)
@@ -461,7 +466,8 @@ static int adm1266_rtc_get(void *data, u64 *val)
 	int ret, i;
 
 	guard(pmbus_lock)(client);
-	ret = i2c_smbus_read_block_data(client, ADM1266_SET_RTC, buf);
+	ret = i2c_smbus_read_block_data(client, ADM1266_SET_RTC,
+					sizeof(buf), buf);
 	if (ret < 0)
 		return ret;
 	if (ret < 6)
@@ -525,7 +531,8 @@ static int adm1266_nvmem_read_blackbox(struct adm1266_data *data, u8 *read_buff)
 	u8 buf[I2C_SMBUS_BLOCK_MAX];
 	int ret;
 
-	ret = i2c_smbus_read_block_data(data->client, ADM1266_BLACKBOX_INFO, buf);
+	ret = i2c_smbus_read_block_data(data->client, ADM1266_BLACKBOX_INFO,
+					sizeof(buf), buf);
 	if (ret < 0)
 		return ret;
 

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 07/31] hwmon: (pmbus/aps-379) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in aps_379_probe()
to account for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/aps-379.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/aps-379.c b/drivers/hwmon/pmbus/aps-379.c
index 3ec0940ae564..a21213c21f7d 100644
--- a/drivers/hwmon/pmbus/aps-379.c
+++ b/drivers/hwmon/pmbus/aps-379.c
@@ -117,7 +117,8 @@ static int aps_379_probe(struct i2c_client *client)
 				     | I2C_FUNC_SMBUS_READ_BLOCK_DATA))
 		return -ENODEV;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read Manufacturer Model\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 08/31] hwmon: (pmbus/bpa-rs600) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer capacity reserving space for a trailing NUL byte to
i2c_smbus_read_block_data(), and ensure the buffer is NUL-terminated
before model name comparison.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/bpa-rs600.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/bpa-rs600.c b/drivers/hwmon/pmbus/bpa-rs600.c
index e364dcb59dd4..b562e1ea7ac5 100644
--- a/drivers/hwmon/pmbus/bpa-rs600.c
+++ b/drivers/hwmon/pmbus/bpa-rs600.c
@@ -166,18 +166,19 @@ static int bpa_rs600_probe(struct i2c_client *client)
 				     | I2C_FUNC_SMBUS_READ_BLOCK_DATA))
 		return -ENODEV;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read Manufacturer Model\n");
 		return ret;
 	}
 
+	buf[ret] = '\0';
 	for (mid = bpa_rs600_id; mid->name[0]; mid++) {
 		if (!strncasecmp(buf, mid->name, strlen(mid->name)))
 			break;
 	}
 	if (!mid->name[0]) {
-		buf[ret] = '\0';
 		dev_err(dev, "Unsupported Manufacturer Model '%s'\n", buf);
 		return -ENODEV;
 	}

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 09/31] hwmon: (pmbus/crps) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in crps_probe()
and shrink the buffer declaration to I2C_SMBUS_BLOCK_MAX + 1 since
only a single NUL terminator byte is needed.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/crps.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/crps.c b/drivers/hwmon/pmbus/crps.c
index 266ec8947519..2be3869ae8c8 100644
--- a/drivers/hwmon/pmbus/crps.c
+++ b/drivers/hwmon/pmbus/crps.c
@@ -31,9 +31,10 @@ static int crps_probe(struct i2c_client *client)
 {
 	int rc;
 	struct device *dev = &client->dev;
-	char buf[I2C_SMBUS_BLOCK_MAX + 2] = { 0 };
+	char buf[I2C_SMBUS_BLOCK_MAX + 1] = { 0 };
 
-	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+				       sizeof(buf) - 1, buf);
 	if (rc < 0)
 		return dev_err_probe(dev, rc, "Failed to read PMBUS_MFR_MODEL\n");
 

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 10/31] hwmon: (pmbus/d1u74t) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() and shrink the
temporary buffer to I2C_SMBUS_BLOCK_MAX + 1 since only a single NUL
terminator byte is needed.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/d1u74t.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/d1u74t.c b/drivers/hwmon/pmbus/d1u74t.c
index 752df3af9c1a..758464a6362d 100644
--- a/drivers/hwmon/pmbus/d1u74t.c
+++ b/drivers/hwmon/pmbus/d1u74t.c
@@ -30,11 +30,12 @@ static struct pmbus_driver_info d1u74t_info = {
 
 static int d1u74t_probe(struct i2c_client *client)
 {
-	char buf[I2C_SMBUS_BLOCK_MAX + 2] = { 0 };
+	char buf[I2C_SMBUS_BLOCK_MAX + 1] = { 0 };
 	struct device *dev = &client->dev;
 	int rc;
 
-	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+				       sizeof(buf) - 1, buf);
 	if (rc < 0)
 		return dev_err_probe(dev, rc, "Failed to read PMBUS_MFR_ID\n");
 
@@ -45,7 +46,8 @@ static int d1u74t_probe(struct i2c_client *client)
 				     buf);
 	}
 
-	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	rc = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+				       sizeof(buf) - 1, buf);
 	if (rc < 0)
 		return dev_err_probe(dev, rc,
 				     "Failed to read PMBUS_MFR_MODEL\n");

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 11/31] hwmon: (pmbus/dps920ab) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in dps920ab_probe()
to leave space for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/dps920ab.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/dps920ab.c b/drivers/hwmon/pmbus/dps920ab.c
index 0d2901c314c2..694b5f386df5 100644
--- a/drivers/hwmon/pmbus/dps920ab.c
+++ b/drivers/hwmon/pmbus/dps920ab.c
@@ -143,7 +143,8 @@ static int dps920ab_probe(struct i2c_client *client)
 	if (!data)
 		return -ENOMEM;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read Manufacturer ID\n");
 		return ret;
@@ -159,7 +160,8 @@ static int dps920ab_probe(struct i2c_client *client)
 	if (!data->mfr_id)
 		return -ENOMEM;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read Manufacturer Model\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 12/31] hwmon: (pmbus/fsp-3y) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in fsp3y_detect()
to leave room for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/fsp-3y.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/fsp-3y.c b/drivers/hwmon/pmbus/fsp-3y.c
index 44cf2db9364b..c59a58001c48 100644
--- a/drivers/hwmon/pmbus/fsp-3y.c
+++ b/drivers/hwmon/pmbus/fsp-3y.c
@@ -205,7 +205,8 @@ static int fsp3y_detect(struct i2c_client *client)
 	int rv;
 	u8 buf[I2C_SMBUS_BLOCK_MAX + 1];
 
-	rv = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	rv = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (rv < 0)
 		return rv;
 

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 13/31] hwmon: (pmbus/ibm-cffps) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer capacity reserving space for a trailing NUL byte to
i2c_smbus_read_block_data(), and shrink the manufacturer ID buffer
to I2C_SMBUS_BLOCK_MAX + 1.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/ibm-cffps.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c
index 2498c6f4778e..adf4b7925771 100644
--- a/drivers/hwmon/pmbus/ibm-cffps.c
+++ b/drivers/hwmon/pmbus/ibm-cffps.c
@@ -490,14 +490,15 @@ static int ibm_cffps_probe(struct i2c_client *client)
 		u16 ccin_revision = 0;
 		u16 ccin_version = CFFPS_CCIN_VERSION_1;
 		int ccin = i2c_smbus_read_word_swapped(client, CFFPS_CCIN_CMD);
-		char mfg_id[I2C_SMBUS_BLOCK_MAX + 2] = { 0 };
+		char mfg_id[I2C_SMBUS_BLOCK_MAX + 1] = { 0 };
 
 		if (ccin > 0) {
 			ccin_revision = FIELD_GET(CFFPS_CCIN_REVISION, ccin);
 			ccin_version = FIELD_GET(CFFPS_CCIN_VERSION, ccin);
 		}
 
-		rc = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, mfg_id);
+		rc = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					       sizeof(mfg_id) - 1, mfg_id);
 		if (rc < 0) {
 			dev_err(&client->dev, "Failed to read Manufacturer ID\n");
 			return rc;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 14/31] hwmon: (pmbus/inspur-ipsps) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data() in
ipsps_string_show() and ipsps_fw_version_show().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/inspur-ipsps.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/inspur-ipsps.c b/drivers/hwmon/pmbus/inspur-ipsps.c
index 57c0fc16909c..01ff392c71d8 100644
--- a/drivers/hwmon/pmbus/inspur-ipsps.c
+++ b/drivers/hwmon/pmbus/inspur-ipsps.c
@@ -62,7 +62,7 @@ static ssize_t ipsps_string_show(struct device *dev,
 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
 
 	reg = ipsps_regs[attr->index];
-	rc = i2c_smbus_read_block_data(client, reg, data);
+	rc = i2c_smbus_read_block_data(client, reg, sizeof(data) - 1, data);
 	if (rc < 0)
 		return rc;
 
@@ -84,7 +84,7 @@ static ssize_t ipsps_fw_version_show(struct device *dev,
 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
 
 	reg = ipsps_regs[attr->index];
-	rc = i2c_smbus_read_block_data(client, reg, data);
+	rc = i2c_smbus_read_block_data(client, reg, sizeof(data), data);
 	if (rc < 0)
 		return rc;
 

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 15/31] hwmon: (pmbus/ir35221) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the size of the receive buffer to i2c_smbus_read_block_data() in
ir35221_probe().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/ir35221.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/ir35221.c b/drivers/hwmon/pmbus/ir35221.c
index b2120fc76f40..346276efff87 100644
--- a/drivers/hwmon/pmbus/ir35221.c
+++ b/drivers/hwmon/pmbus/ir35221.c
@@ -79,7 +79,8 @@ static int ir35221_probe(struct i2c_client *client)
 				| I2C_FUNC_SMBUS_READ_BLOCK_DATA))
 		return -ENODEV;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(buf), buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read PMBUS_MFR_ID\n");
 		return ret;
@@ -89,7 +90,8 @@ static int ir35221_probe(struct i2c_client *client)
 		return -ENODEV;
 	}
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf), buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read PMBUS_MFR_MODEL\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 16/31] hwmon: (pmbus/lt7182s) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in lt7182s_probe()
to leave space for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/lt7182s.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/lt7182s.c b/drivers/hwmon/pmbus/lt7182s.c
index f8971a786f25..62e180dd5dbf 100644
--- a/drivers/hwmon/pmbus/lt7182s.c
+++ b/drivers/hwmon/pmbus/lt7182s.c
@@ -113,7 +113,8 @@ static int lt7182s_probe(struct i2c_client *client)
 				     I2C_FUNC_SMBUS_READ_BLOCK_DATA))
 		return -ENODEV;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read PMBUS_MFR_ID\n");
 		return ret;
@@ -124,7 +125,8 @@ static int lt7182s_probe(struct i2c_client *client)
 		return -ENODEV;
 	}
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read PMBUS_MFR_MODEL\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 17/31] hwmon: (pmbus/ltc4286) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(block_buffer) - 1 to i2c_smbus_read_block_data() in
ltc4286_probe() to leave room for the NUL terminator, and explicitly
terminate the buffer before comparing model strings.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/ltc4286.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
index 8190706d1beb..530eace926ae 100644
--- a/drivers/hwmon/pmbus/ltc4286.c
+++ b/drivers/hwmon/pmbus/ltc4286.c
@@ -155,7 +155,8 @@ static int ltc4286_probe(struct i2c_client *client)
 	u32 rsense;
 	int vrange_nval, vrange_oval;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, block_buffer);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(block_buffer) - 1, block_buffer);
 	if (ret < 0) {
 		return dev_err_probe(&client->dev, ret,
 				     "Failed to read manufacturer id\n");
@@ -171,12 +172,15 @@ static int ltc4286_probe(struct i2c_client *client)
 				     "Manufacturer id mismatch\n");
 	}
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(block_buffer) - 1, block_buffer);
 	if (ret < 0) {
 		return dev_err_probe(&client->dev, ret,
 				     "Failed to read manufacturer model\n");
 	}
 
+	block_buffer[ret] = '\0';
+
 	for (mid = ltc4286_id; mid->name[0]; mid++) {
 		if (!strncasecmp(mid->name, block_buffer, strlen(mid->name)))
 			break;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 18/31] hwmon: (pmbus/lx1308) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in lx1308_probe()
to leave space for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/lx1308.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/lx1308.c b/drivers/hwmon/pmbus/lx1308.c
index 0c453393796b..37519bda594f 100644
--- a/drivers/hwmon/pmbus/lx1308.c
+++ b/drivers/hwmon/pmbus/lx1308.c
@@ -151,7 +151,8 @@ static int lx1308_probe(struct i2c_client *client)
 	const struct i2c_device_id *mid;
 	int ret;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(buf) - 1, buf);
 	if (ret < 0)
 		return dev_err_probe(&client->dev, ret,
 				     "Failed to read manufacturer id\n");
@@ -161,7 +162,8 @@ static int lx1308_probe(struct i2c_client *client)
 		return dev_err_probe(&client->dev, -ENODEV,
 				     "Unsupported Manufacturer ID '%s'\n", buf);
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0)
 		return dev_err_probe(&client->dev, ret,
 				     "Failed to read Manufacturer Model\n");
@@ -175,7 +177,8 @@ static int lx1308_probe(struct i2c_client *client)
 		return dev_err_probe(&client->dev, -ENODEV,
 				     "Unsupported Manufacturer Model '%s'\n", buf);
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_REVISION, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_REVISION,
+					sizeof(buf) - 1, buf);
 	if (ret < 0)
 		return dev_err_probe(&client->dev, ret,
 				     "Failed to read Manufacturer Revision\n");

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 19/31] hwmon: (pmbus/max15301) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer capacity reserving space for a trailing NUL byte to
i2c_smbus_read_block_data(), and ensure the device ID buffer is
NUL-terminated before comparison.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/max15301.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/max15301.c b/drivers/hwmon/pmbus/max15301.c
index 4c36f1ea27ee..4db35453e432 100644
--- a/drivers/hwmon/pmbus/max15301.c
+++ b/drivers/hwmon/pmbus/max15301.c
@@ -66,11 +66,13 @@ static int max15301_probe(struct i2c_client *client)
 				     | I2C_FUNC_SMBUS_BLOCK_DATA))
 		return -ENODEV;
 
-	status = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, device_id);
+	status = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID,
+					   sizeof(device_id) - 1, device_id);
 	if (status < 0) {
 		dev_err(&client->dev, "Failed to read Device Id\n");
 		return status;
 	}
+	device_id[status] = '\0';
 	for (mid = max15301_id; mid->name[0]; mid++) {
 		if (!strncasecmp(mid->name, device_id, strlen(mid->name)))
 			break;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 20/31] hwmon: (pmbus/max16601) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data() and shrink the
temporary buffer in max16601_read_word() to I2C_SMBUS_BLOCK_MAX since
it holds binary data and is never NUL-terminated.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/max16601.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/max16601.c b/drivers/hwmon/pmbus/max16601.c
index 3dd1f6fd003b..3f4e3c24b985 100644
--- a/drivers/hwmon/pmbus/max16601.c
+++ b/drivers/hwmon/pmbus/max16601.c
@@ -73,7 +73,7 @@ static int max16601_read_word(struct i2c_client *client, int page, int phase,
 {
 	const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
 	struct max16601_data *data = to_max16601_data(info);
-	u8 buf[I2C_SMBUS_BLOCK_MAX + 1];
+	u8 buf[I2C_SMBUS_BLOCK_MAX];
 	int ret;
 
 	switch (page) {
@@ -90,7 +90,7 @@ static int max16601_read_word(struct i2c_client *client, int page, int phase,
 				return ret;
 			ret = i2c_smbus_read_block_data(client,
 							REG_PHASE_REPORTING,
-							buf);
+							sizeof(buf), buf);
 			if (ret < 0)
 				return ret;
 			if (ret < 6)
@@ -278,7 +278,8 @@ static int max16601_get_id(struct i2c_client *client)
 	enum chips id;
 	int ret;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID,
+					sizeof(buf) - 1, buf);
 	if (ret < 0 || ret < 11)
 		return -ENODEV;
 

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 21/31] hwmon: (pmbus/max20730) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(buf) - 1 to i2c_smbus_read_block_data() in max20730_probe()
to leave space for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/max20730.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/max20730.c b/drivers/hwmon/pmbus/max20730.c
index 4031f894e6ae..b48ae06e3fa0 100644
--- a/drivers/hwmon/pmbus/max20730.c
+++ b/drivers/hwmon/pmbus/max20730.c
@@ -672,7 +672,8 @@ static int max20730_probe(struct i2c_client *client)
 				     I2C_FUNC_SMBUS_BLOCK_DATA))
 		return -ENODEV;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read Manufacturer ID\n");
 		return ret;
@@ -693,7 +694,8 @@ static int max20730_probe(struct i2c_client *client)
 	 * a mismatch. If that doesn't work for all chips, we may have
 	 * to remove this check.
 	 */
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read Manufacturer Model\n");
 		return ret;
@@ -704,7 +706,8 @@ static int max20730_probe(struct i2c_client *client)
 		return -ENODEV;
 	}
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_REVISION, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_REVISION,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read Manufacturer Revision\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 22/31] hwmon: (pmbus/mp5920) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the size of the receive buffer to i2c_smbus_read_block_data() in
mp5920_probe().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/mp5920.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/mp5920.c b/drivers/hwmon/pmbus/mp5920.c
index b803f3ddf8ea..5c61b3c610d1 100644
--- a/drivers/hwmon/pmbus/mp5920.c
+++ b/drivers/hwmon/pmbus/mp5920.c
@@ -46,7 +46,8 @@ static int mp5920_probe(struct i2c_client *client)
 				     I2C_FUNC_SMBUS_READ_WORD_DATA))
 		return -ENODEV;
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf), buf);
 	if (ret < 0)
 		return dev_err_probe(dev, ret, "Failed to read PMBUS_MFR_MODEL\n");
 

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 23/31] hwmon: (pmbus/pim4328) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(device_id) - 1 to i2c_smbus_read_block_data() in
pim4328_probe() to leave room for the NUL terminator, and ensure the
buffer is NUL-terminated before string comparisons.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/pim4328.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/pim4328.c b/drivers/hwmon/pmbus/pim4328.c
index 9056dc387e87..2216f8db7ccb 100644
--- a/drivers/hwmon/pmbus/pim4328.c
+++ b/drivers/hwmon/pmbus/pim4328.c
@@ -150,11 +150,13 @@ static int pim4328_probe(struct i2c_client *client)
 	if (!data)
 		return -ENOMEM;
 
-	status = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, device_id);
+	status = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					   sizeof(device_id) - 1, device_id);
 	if (status < 0) {
 		dev_err(&client->dev, "Failed to read Manufacturer Model\n");
 		return status;
 	}
+	device_id[status] = '\0';
 	for (mid = pim4328_id; mid->name[0]; mid++) {
 		if (!strncasecmp(mid->name, device_id, strlen(mid->name)))
 			break;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 24/31] hwmon: (pmbus) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass I2C_SMBUS_BLOCK_MAX to i2c_smbus_read_block_data() in
pmbus_read_smbus_i2c_block_data().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/pmbus_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 369a3bed8c87..0f49eb41efcc 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -560,7 +560,8 @@ int pmbus_read_smbus_i2c_block_data(struct i2c_client *client, u8 reg, char *dat
 	if (i2c_check_functionality(client->adapter,
 				    I2C_FUNC_SMBUS_READ_BLOCK_DATA)) {
 		pmbus_wait(client);
-		ret = i2c_smbus_read_block_data(client, reg, data_buf);
+		ret = i2c_smbus_read_block_data(client, reg,
+						I2C_SMBUS_BLOCK_MAX, data_buf);
 		pmbus_update_ts(client, 0);
 		return ret;
 	}

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 25/31] hwmon: (pmbus/pxe1610) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the size of the receive buffer to i2c_smbus_read_block_data() in
pxe1610_probe().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/pxe1610.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
index 6ba2b3e0e565..6c1d362661ad 100644
--- a/drivers/hwmon/pmbus/pxe1610.c
+++ b/drivers/hwmon/pmbus/pxe1610.c
@@ -110,7 +110,7 @@ static int pxe1610_probe(struct i2c_client *client)
 				     "Failed to set page 0\n");
 
 	/* Read Manufacturer id */
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, sizeof(buf), buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read PMBUS_MFR_ID\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 26/31] hwmon: (pmbus/q54sj108a2) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data() in
q54sj108a2_debugfs_read() and q54sj108a2_probe().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/q54sj108a2.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/drivers/hwmon/pmbus/q54sj108a2.c b/drivers/hwmon/pmbus/q54sj108a2.c
index ecac405d7536..8ce1824249e7 100644
--- a/drivers/hwmon/pmbus/q54sj108a2.c
+++ b/drivers/hwmon/pmbus/q54sj108a2.c
@@ -120,22 +120,26 @@ static ssize_t q54sj108a2_debugfs_read(struct file *file, char __user *buf,
 		rc = snprintf(data, 3, "%02x", rc);
 		break;
 	case Q54SJ108A2_DEBUGFS_MFR_ID:
-		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_ID, data);
+		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_ID,
+					       I2C_SMBUS_BLOCK_MAX, data);
 		if (rc < 0)
 			return rc;
 		break;
 	case Q54SJ108A2_DEBUGFS_MFR_MODEL:
-		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_MODEL, data);
+		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_MODEL,
+					       I2C_SMBUS_BLOCK_MAX, data);
 		if (rc < 0)
 			return rc;
 		break;
 	case Q54SJ108A2_DEBUGFS_MFR_REVISION:
-		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_REVISION, data);
+		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_REVISION,
+					       I2C_SMBUS_BLOCK_MAX, data);
 		if (rc < 0)
 			return rc;
 		break;
 	case Q54SJ108A2_DEBUGFS_MFR_LOCATION:
-		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_LOCATION, data);
+		rc = i2c_smbus_read_block_data(psu->client, PMBUS_MFR_LOCATION,
+					       I2C_SMBUS_BLOCK_MAX, data);
 		if (rc < 0)
 			return rc;
 		break;
@@ -147,7 +151,8 @@ static ssize_t q54sj108a2_debugfs_read(struct file *file, char __user *buf,
 		rc = snprintf(data, 3, "%02x", rc);
 		break;
 	case Q54SJ108A2_DEBUGFS_BLACKBOX_READ:
-		rc = i2c_smbus_read_block_data(psu->client, READ_HISTORY_EVENTS, data);
+		rc = i2c_smbus_read_block_data(psu->client, READ_HISTORY_EVENTS,
+					       I2C_SMBUS_BLOCK_MAX, data);
 		if (rc < 0)
 			return rc;
 
@@ -156,7 +161,8 @@ static ssize_t q54sj108a2_debugfs_read(struct file *file, char __user *buf,
 		out = data_char;
 		break;
 	case Q54SJ108A2_DEBUGFS_FLASH_KEY:
-		rc = i2c_smbus_read_block_data(psu->client, PMBUS_FLASH_KEY_WRITE, data);
+		rc = i2c_smbus_read_block_data(psu->client, PMBUS_FLASH_KEY_WRITE,
+					       I2C_SMBUS_BLOCK_MAX, data);
 		if (rc < 0)
 			return rc;
 
@@ -297,7 +303,8 @@ static int q54sj108a2_probe(struct i2c_client *client)
 
 	chip_id = (enum chips)(uintptr_t)i2c_get_match_data(client);
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read Manufacturer ID\n");
 		return ret;
@@ -311,7 +318,8 @@ static int q54sj108a2_probe(struct i2c_client *client)
 	/*
 	 * The chips support reading PMBUS_MFR_MODEL.
 	 */
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read Manufacturer Model\n");
 		return ret;
@@ -326,7 +334,8 @@ static int q54sj108a2_probe(struct i2c_client *client)
 		return -ENODEV;
 	}
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_REVISION, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_REVISION,
+					sizeof(buf) - 1, buf);
 	if (ret < 0) {
 		dev_err(dev, "Failed to read Manufacturer Revision\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 27/31] hwmon: (pmbus/stpddc60) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(device_id) - 1 to i2c_smbus_read_block_data() in
stpddc60_probe() to leave room for the NUL terminator, and ensure the
buffer is NUL-terminated before string comparisons.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/stpddc60.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/stpddc60.c b/drivers/hwmon/pmbus/stpddc60.c
index b5ce7f975eea..9118517eabe8 100644
--- a/drivers/hwmon/pmbus/stpddc60.c
+++ b/drivers/hwmon/pmbus/stpddc60.c
@@ -205,11 +205,13 @@ static int stpddc60_probe(struct i2c_client *client)
 				     | I2C_FUNC_SMBUS_BLOCK_DATA))
 		return -ENODEV;
 
-	status = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, device_id);
+	status = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL,
+					   sizeof(device_id) - 1, device_id);
 	if (status < 0) {
 		dev_err(&client->dev, "Failed to read Manufacturer Model\n");
 		return status;
 	}
+	device_id[status] = '\0';
 	for (mid = stpddc60_id; mid->name[0]; mid++) {
 		if (!strncasecmp(mid->name, device_id, strlen(mid->name)))
 			break;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 28/31] hwmon: (pmbus/tps53679) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data() in
tps53679_identify_chip() and tps536xx_read_block().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/tps53679.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
index a04a632a5091..e6c5fd630f86 100644
--- a/drivers/hwmon/pmbus/tps53679.c
+++ b/drivers/hwmon/pmbus/tps53679.c
@@ -110,7 +110,8 @@ static int tps53679_identify_chip(struct i2c_client *client,
 		return -ENODEV;
 	}
 
-	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID,
+					sizeof(buf), buf);
 	if (ret <= 0)
 		return ret < 0 ? ret : -EIO;
 
@@ -176,7 +177,8 @@ static int tps53681_identify(struct i2c_client *client,
 static int tps536xx_read_block(struct i2c_client *client, u8 reg, u8 *buf,
 			       bool retry_without_pec)
 {
-	int ret = i2c_smbus_read_block_data(client, reg, buf);
+	int ret = i2c_smbus_read_block_data(client, reg,
+					    I2C_SMBUS_BLOCK_MAX, buf);
 
 	/*
 	 * Some TPS536C7 samples return an invalid PEC on the device-ID and
@@ -186,7 +188,8 @@ static int tps536xx_read_block(struct i2c_client *client, u8 reg, u8 *buf,
 	if (ret == -EBADMSG && retry_without_pec &&
 	    (client->flags & I2C_CLIENT_PEC)) {
 		client->flags &= ~I2C_CLIENT_PEC;
-		ret = i2c_smbus_read_block_data(client, reg, buf);
+		ret = i2c_smbus_read_block_data(client, reg,
+						I2C_SMBUS_BLOCK_MAX, buf);
 		client->flags |= I2C_CLIENT_PEC;
 	}
 	return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 29/31] hwmon: (pmbus/ucd9000) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass the buffer size to i2c_smbus_read_block_data() in
ucd9000_get_mfr_status() and ucd9000_probe().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/ucd9000.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/ucd9000.c b/drivers/hwmon/pmbus/ucd9000.c
index f76c2913c9ca..2645d3e78e3f 100644
--- a/drivers/hwmon/pmbus/ucd9000.c
+++ b/drivers/hwmon/pmbus/ucd9000.c
@@ -390,7 +390,8 @@ static int ucd9000_get_mfr_status(struct i2c_client *client, u8 *buffer)
 	if (ret < 0)
 		return ret;
 
-	return i2c_smbus_read_block_data(client, UCD9000_MFR_STATUS, buffer);
+	return i2c_smbus_read_block_data(client, UCD9000_MFR_STATUS,
+					  I2C_SMBUS_BLOCK_MAX, buffer);
 }
 
 static int ucd9000_debugfs_show_mfr_status_bit(void *data, u64 *val)
@@ -515,7 +516,7 @@ static int ucd9000_probe(struct i2c_client *client)
 		return -ENODEV;
 
 	ret = i2c_smbus_read_block_data(client, UCD9000_DEVICE_ID,
-					block_buffer);
+					sizeof(block_buffer) - 1, block_buffer);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read device ID\n");
 		return ret;
@@ -565,7 +566,7 @@ static int ucd9000_probe(struct i2c_client *client)
 
 	/* Everything else is configurable */
 	ret = i2c_smbus_read_block_data(client, UCD9000_MONITOR_CONFIG,
-					block_buffer);
+					sizeof(block_buffer) - 1, block_buffer);
 	if (ret <= 0) {
 		dev_err(&client->dev, "Failed to read configuration data\n");
 		return -ENODEV;
@@ -602,6 +603,7 @@ static int ucd9000_probe(struct i2c_client *client)
 						  UCD9000_FAN_CONFIG_INDEX, i);
 			ret = i2c_smbus_read_block_data(client,
 							UCD9000_FAN_CONFIG,
+							sizeof(data->fan_data[i]),
 							data->fan_data[i]);
 			if (ret < 0)
 				return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 30/31] hwmon: (pmbus/ucd9200) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(block_buffer) - 1 to i2c_smbus_read_block_data() in
ucd9200_probe() to leave space for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/ucd9200.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/ucd9200.c b/drivers/hwmon/pmbus/ucd9200.c
index 5e07bba111a1..08bb91e095bb 100644
--- a/drivers/hwmon/pmbus/ucd9200.c
+++ b/drivers/hwmon/pmbus/ucd9200.c
@@ -85,7 +85,7 @@ static int ucd9200_probe(struct i2c_client *client)
 		return -ENODEV;
 
 	ret = i2c_smbus_read_block_data(client, UCD9200_DEVICE_ID,
-					block_buffer);
+					sizeof(block_buffer) - 1, block_buffer);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read device ID\n");
 		return ret;
@@ -118,7 +118,7 @@ static int ucd9200_probe(struct i2c_client *client)
 		return -ENOMEM;
 
 	ret = i2c_smbus_read_block_data(client, UCD9200_PHASE_INFO,
-					block_buffer);
+					sizeof(block_buffer) - 1, block_buffer);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read phase information\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog

[PATCH 31/31] hwmon: (pmbus/zl6100) use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov]

Pass sizeof(device_id) - 1 to i2c_smbus_read_block_data() in
zl6100_probe() to leave space for the NUL terminator.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hwmon/pmbus/zl6100.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
index 5db2a7818d16..43f59cfc313f 100644
--- a/drivers/hwmon/pmbus/zl6100.c
+++ b/drivers/hwmon/pmbus/zl6100.c
@@ -290,7 +290,7 @@ static int zl6100_probe(struct i2c_client *client)
 		return -ENODEV;
 
 	ret = i2c_smbus_read_block_data(client, ZL6100_DEVICE_ID,
-					device_id);
+					sizeof(device_id) - 1, device_id);
 	if (ret < 0) {
 		dev_err(&client->dev, "Failed to read device ID\n");
 		return ret;

-- 
2.56.0.257.gf7497c7d27-goog