diff options
Diffstat (limited to 'patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch')
| -rw-r--r-- | patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch b/patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch new file mode 100644 index 00000000000000..6201fbc36209b3 --- /dev/null +++ b/patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch @@ -0,0 +1,46 @@ +From 6a59f36557bdca43a93bfa3de8be6b984248d29e Mon Sep 17 00:00:00 2001 +From: Wenwen Wang <wang6495@umn.edu> +Date: Sat, 5 May 2018 08:02:21 -0500 +Subject: [PATCH 1801/1808] i2c: core: smbus: fix a potential missing-check bug + +In i2c_smbus_xfer_emulated(), the function i2c_transfer() is invoked to +transfer i2c messages. The number of actual transferred messages is +returned and saved to 'status'. If 'status' is negative, that means an +error occurred during the transfer process. In that case, the value of +'status' is an error code to indicate the reason of the transfer failure. +In most cases, i2c_transfer() can transfer 'num' messages with no error. +And so 'status' == 'num'. However, due to unexpected errors, it is probable +that only partial messages are transferred by i2c_transfer(). As a result, +'status' != 'num'. This special case is not checked after the invocation of +i2c_transfer() and can potentially lead to unexpected issues in the +following execution since it is expected that 'status' == 'num'. + +This patch checks the return value of i2c_transfer() and returns an error +code -EIO if the number of actual transferred messages 'status' is not +equal to 'num'. + +Signed-off-by: Wenwen Wang <wang6495@umn.edu> +Signed-off-by: Wolfram Sang <wsa@the-dreams.de> +(cherry picked from commit 8e03477cb709b73a2c1e1f4349ee3b7b33c50416) +Signed-off-by: Simon Horman <horms+renesas@verge.net.au> +Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> +--- + drivers/i2c/i2c-core-smbus.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c +index 9acb643798eb..60b1ee21709c 100644 +--- a/drivers/i2c/i2c-core-smbus.c ++++ b/drivers/i2c/i2c-core-smbus.c +@@ -461,6 +461,8 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, + status = i2c_transfer(adapter, msg, num); + if (status < 0) + return status; ++ if (status != num) ++ return -EIO; + + /* Check PEC if last message is a read */ + if (i && (msg[num-1].flags & I2C_M_RD)) { +-- +2.17.1 + |