Merge tag 'i2c-host-6.13-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow

i2c-host updates for v6.13, part 1

Major Improvements and Refactoring:

 - All controllers using the 'remove_new' callback have been
   reverted to use the 'remove' callback.

 - Intel SCH controller underwent significant refactoring,
   this brings love and a modern look to the driver.

 - PIIX4 driver refactored to enable usage by other drivers
   (e.g., AMD ASF).

 - iMX/MXC improved message handling to reduce protocol overhead:
     Refactored DMA/non-DMA read/write and bus polling mechanisms
     to achieve this.

 - ACPI documentation for PIIX4.

New Features:

 - i2c-cadence added support for atomic transfers.
 - Qualcomm CII added support for a 32MHz serial engine clock.

Deprecated Features:

 - Dropped outdated support for AMD756 S4882 and NFORCE2 S4985. If
   somebody misses this, Jean will rewrite support using the proper
   i2c mux framework.

New Hardware Support:

 - Added support for:
   - Intel Panther Lake (new ID)
   - AMD ASF (new driver)
   - S32G2/S32G3 SoCs (new ID)
   - Realtek RTL I2C Controller (new driver)
   - HJMC01 DesignWare ACPI HID (new ID)
   - PIC64GX to Microchip Core (new ID)
   - Qualcomm SDM670 to Qualcomm CCI (new ID)

1 files changed, 11 insertions, 4 deletions

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 75e4fe83c5091..5cd1c7a23848c 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3523,7 +3523,7 @@ end:
  *   (i + 1) * elem_size
  * where i is the repeat index and elem_size is the size of an element.
  */
-static int btf_repeat_fields(struct btf_field_info *info,
+static int btf_repeat_fields(struct btf_field_info *info, int info_cnt,
 			     u32 field_cnt, u32 repeat_cnt, u32 elem_size)
 {
 	u32 i, j;
@@ -3543,6 +3543,12 @@ static int btf_repeat_fields(struct btf_field_info *info,
 		}
 	}
 
+	/* The type of struct size or variable size is u32,
+	 * so the multiplication will not overflow.
+	 */
+	if (field_cnt * (repeat_cnt + 1) > info_cnt)
+		return -E2BIG;
+
 	cur = field_cnt;
 	for (i = 0; i < repeat_cnt; i++) {
 		memcpy(&info[cur], &info[0], field_cnt * sizeof(info[0]));
@@ -3587,7 +3593,7 @@ static int btf_find_nested_struct(const struct btf *btf, const struct btf_type *
 		info[i].off += off;
 
 	if (nelems > 1) {
-		err = btf_repeat_fields(info, ret, nelems - 1, t->size);
+		err = btf_repeat_fields(info, info_cnt, ret, nelems - 1, t->size);
 		if (err == 0)
 			ret *= nelems;
 		else
@@ -3681,10 +3687,10 @@ static int btf_find_field_one(const struct btf *btf,
 
 	if (ret == BTF_FIELD_IGNORE)
 		return 0;
-	if (nelems > info_cnt)
+	if (!info_cnt)
 		return -E2BIG;
 	if (nelems > 1) {
-		ret = btf_repeat_fields(info, 1, nelems - 1, sz);
+		ret = btf_repeat_fields(info, info_cnt, 1, nelems - 1, sz);
 		if (ret < 0)
 			return ret;
 	}
@@ -8961,6 +8967,7 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
 	if (!type) {
 		bpf_log(ctx->log, "relo #%u: bad type id %u\n",
 			relo_idx, relo->type_id);
+		kfree(specs);
 		return -EINVAL;
 	}