Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors  adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as  	pins_status = read_buf[0] + (read_buf[1] << 8);  right after i2c_smbus_read_block_data(), guarding only against an error return.  A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too.  If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is.  The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls).  That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response.  Add the missing length check to both call sites and surface a short response as -EIO.