i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

The data->block[0] variable comes from user. Without proper check,
the variable may be very large to cause an out-of-bounds bug.

Fix this bug by checking the value of data->block[0] first.

1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
ismt_access()")
2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
xgene_slimpro_i2c_xfer()")

Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
Signed-off-by: Alex Guo <[e-mail]>
Cc: <[e-mail]> # v6.13+
Reviewed-by: Chris Packham <[e-mail]>
Tested-by: Chris Packham <[e-mail]>
Reviewed-by: Wolfram Sang <[e-mail]>
Signed-off-by: Sven Eckelmann <[e-mail]>
Signed-off-by: Andi Shyti <[e-mail]>
Link: https://lore.kernel.org/r/[e-mail]

drivers/i2c/busses/i2c-rtl9300.c

···
 		ret = rtl9300_i2c_reg_addr_set(i2c, command, 1);
 		if (ret)
 			goto out_unlock;
+		if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
 		ret = rtl9300_i2c_config_xfer(i2c, chan, addr, data->block[0]);
 		if (ret)
 			goto out_unlock;