| From 6a59f36557bdca43a93bfa3de8be6b984248d29e Mon Sep 17 00:00:00 2001 |
| From: Wenwen Wang <wang6495@umn.edu> |
| Date: Sat, 5 May 2018 08:02:21 -0500 |
| Subject: [PATCH 1801/1808] i2c: core: smbus: fix a potential missing-check bug |
| |
| In i2c_smbus_xfer_emulated(), the function i2c_transfer() is invoked to |
| transfer i2c messages. The number of actual transferred messages is |
| returned and saved to 'status'. If 'status' is negative, that means an |
| error occurred during the transfer process. In that case, the value of |
| 'status' is an error code to indicate the reason of the transfer failure. |
| In most cases, i2c_transfer() can transfer 'num' messages with no error. |
| And so 'status' == 'num'. However, due to unexpected errors, it is probable |
| that only partial messages are transferred by i2c_transfer(). As a result, |
| 'status' != 'num'. This special case is not checked after the invocation of |
| i2c_transfer() and can potentially lead to unexpected issues in the |
| following execution since it is expected that 'status' == 'num'. |
| |
| This patch checks the return value of i2c_transfer() and returns an error |
| code -EIO if the number of actual transferred messages 'status' is not |
| equal to 'num'. |
| |
| Signed-off-by: Wenwen Wang <wang6495@umn.edu> |
| Signed-off-by: Wolfram Sang <wsa@the-dreams.de> |
| (cherry picked from commit 8e03477cb709b73a2c1e1f4349ee3b7b33c50416) |
| Signed-off-by: Simon Horman <horms+renesas@verge.net.au> |
| Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> |
| --- |
| drivers/i2c/i2c-core-smbus.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c |
| index 9acb643798eb..60b1ee21709c 100644 |
| --- a/drivers/i2c/i2c-core-smbus.c |
| +++ b/drivers/i2c/i2c-core-smbus.c |
| @@ -461,6 +461,8 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, |
| status = i2c_transfer(adapter, msg, num); |
| if (status < 0) |
| return status; |
| + if (status != num) |
| + return -EIO; |
| |
| /* Check PEC if last message is a read */ |
| if (i && (msg[num-1].flags & I2C_M_RD)) { |
| -- |
| 2.17.1 |
| |
