Hi,

On Sat, Oct 24, 2026 at 07:48:48PM -0700, Dmitry Torokhov wrote:
> Pass the destination buffer size to sbs_read_string_data(), and pass
> the buffer capacity reserving space for a trailing NUL terminator to
> i2c_smbus_read_block_data().
> 
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---

Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>

-- Sebastian

>  drivers/power/supply/sbs-battery.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
> index 6714313bb3a3..f8b194c58a62 100644
> --- a/drivers/power/supply/sbs-battery.c
> +++ b/drivers/power/supply/sbs-battery.c
> @@ -424,7 +424,8 @@ static int sbs_read_string_data_fallback(struct i2c_client *client, u8 address,
>  	return ret;
>  }
>  
> -static int sbs_read_string_data(struct i2c_client *client, u8 address, char *values)
> +static int sbs_read_string_data(struct i2c_client *client, u8 address,
> +				char *values, size_t size)
>  {
>  	struct sbs_info *chip = i2c_get_clientdata(client);
>  	int retries = chip->i2c_retry_count;
> @@ -440,7 +441,7 @@ static int sbs_read_string_data(struct i2c_client *client, u8 address, char *val
>  	}
>  
>  	while (retries > 0) {
> -		ret = i2c_smbus_read_block_data(client, address, values);
> +		ret = i2c_smbus_read_block_data(client, address, size - 1, values);
>  		if (ret >= 0)
>  			break;
>  		retries--;
> @@ -709,7 +710,8 @@ static const char *sbs_get_constant_string(struct sbs_info *chip,
>  
>  		addr = sbs_data[ret].addr;
>  
> -		ret = sbs_read_string_data(chip->client, addr, buf);
> +		ret = sbs_read_string_data(chip->client, addr, buf,
> +					   sizeof(chip->strings[0]));
>  		if (ret < 0)
>  			return ERR_PTR(ret);
>  	}
> 
> -- 
> 2.56.0.257.gf7497c7d27-goog
>