summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorDoug Anderson <dianders@chromium.org>2014-06-27 12:56:12 -0700
committerLee Jones <lee.jones@linaro.org>2014-07-09 16:38:21 +0100
commitd6c15ed2bc703139df1c87666fb69077ad6d44d9 (patch)
tree87f0f8d31aeecf78b7e6ef54dacc3f50b4837823 /drivers
parent7ccf40b1a1aa060cc0c95bf00cf66f9e88636404 (diff)
mfd: cros_ec: Use the proper size when looking at the cros_ec_i2c result
We know how many bytes the EC should be sending us (which is also the number of bytes transferred) and also how many bytes the EC actually wanted to send to us. When computing the checksum and copying back data let's make sure we take the lesser of the two of those. We'll also complain if the EC tried to send us too many bytes. The EC sending us too few bytes is legit for when we send the EC an invalid command. This is based on similar code in cros_ec_spi. Signed-off-by: Doug Anderson <dianders@chromium.org> Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Lee Jones <lee.jones@linaro.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/mfd/cros_ec_i2c.c15
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/mfd/cros_ec_i2c.c b/drivers/mfd/cros_ec_i2c.c
index fd7a546d3478..c0c30f4f946f 100644
--- a/drivers/mfd/cros_ec_i2c.c
+++ b/drivers/mfd/cros_ec_i2c.c
@@ -35,6 +35,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
struct i2c_client *client = ec_dev->priv;
int ret = -ENOMEM;
int i;
+ int len;
int packet_len;
u8 *out_buf = NULL;
u8 *in_buf = NULL;
@@ -97,21 +98,29 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
if (ret)
goto done;
+ len = in_buf[1];
+ if (len > msg->insize) {
+ dev_err(ec_dev->dev, "packet too long (%d bytes, expected %d)",
+ len, msg->insize);
+ ret = -ENOSPC;
+ goto done;
+ }
+
/* copy response packet payload and compute checksum */
sum = in_buf[0] + in_buf[1];
- for (i = 0; i < msg->insize; i++) {
+ for (i = 0; i < len; i++) {
msg->indata[i] = in_buf[2 + i];
sum += in_buf[2 + i];
}
dev_dbg(ec_dev->dev, "packet: %*ph, sum = %02x\n",
i2c_msg[1].len, in_buf, sum);
- if (sum != in_buf[2 + msg->insize]) {
+ if (sum != in_buf[2 + len]) {
dev_err(ec_dev->dev, "bad packet checksum\n");
ret = -EBADMSG;
goto done;
}
- ret = i2c_msg[1].buf[1];
+ ret = len;
done:
kfree(in_buf);
kfree(out_buf);