lkml.org 
[lkml]   [2018]   [Jul]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 45/56] i2c: core: smbus: fix a potential missing-check bug
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Wenwen Wang <wang6495@umn.edu>

    commit 8e03477cb709b73a2c1e1f4349ee3b7b33c50416 upstream.

    In i2c_smbus_xfer_emulated(), the function i2c_transfer() is invoked to
    transfer i2c messages. The number of actual transferred messages is
    returned and saved to 'status'. If 'status' is negative, that means an
    error occurred during the transfer process. In that case, the value of
    'status' is an error code to indicate the reason of the transfer failure.
    In most cases, i2c_transfer() can transfer 'num' messages with no error.
    And so 'status' == 'num'. However, due to unexpected errors, it is probable
    that only partial messages are transferred by i2c_transfer(). As a result,
    'status' != 'num'. This special case is not checked after the invocation of
    i2c_transfer() and can potentially lead to unexpected issues in the
    following execution since it is expected that 'status' == 'num'.

    This patch checks the return value of i2c_transfer() and returns an error
    code -EIO if the number of actual transferred messages 'status' is not
    equal to 'num'.

    Signed-off-by: Wenwen Wang <wang6495@umn.edu>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/i2c/i2c-core-smbus.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/drivers/i2c/i2c-core-smbus.c
    +++ b/drivers/i2c/i2c-core-smbus.c
    @@ -466,6 +466,8 @@ static s32 i2c_smbus_xfer_emulated(struc
    status = i2c_transfer(adapter, msg, num);
    if (status < 0)
    return status;
    + if (status != num)
    + return -EIO;

    /* Check PEC if last message is a read */
    if (i && (msg[num-1].flags & I2C_M_RD)) {

    \
     
     \ /
      Last update: 2018-07-10 20:59    [W:4.034 / U:0.304 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site