leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mfd: cros_ec: Use the proper size when looking at the cros_ec_i2c result

Browse Source 
We know how many bytes the EC should be sending us (which is also the
number of bytes transferred) and also how many bytes the EC actually
wanted to send to us.  When computing the checksum and copying back
data let's make sure we take the lesser of the two of those.  We'll
also complain if the EC tried to send us too many bytes.  The EC
sending us too few bytes is legit for when we send the EC an invalid
command.

This is based on similar code in cros_ec_spi.

Signed-off-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
This commit is contained in:
Doug Anderson 2014-06-27 12:56:12 -07:00 committed by Lee Jones
parent 7ccf40b1a1
commit d6c15ed2bc
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/mfd/cros_ec_i2c.c
View File

@ -35,6 +35,7 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
struct i2c_client *client = ec_dev->priv;
int ret = -ENOMEM;
int i;
int len;
int packet_len;
u8 *out_buf = NULL;
u8 *in_buf = NULL;
@ -97,21 +98,29 @@ static int cros_ec_cmd_xfer_i2c(struct cros_ec_device *ec_dev,
if (ret)
goto done;
len = in_buf[1];
if (len > msg->insize) {
dev_err(ec_dev->dev, "packet too long (%d bytes, expected %d)",
len, msg->insize);
ret = -ENOSPC;
goto done;
}
/* copy response packet payload and compute checksum */
sum = in_buf[0] + in_buf[1];
for (i = 0; i < msg->insize; i++) {
for (i = 0; i < len; i++) {
msg->indata[i] = in_buf[2 + i];
sum += in_buf[2 + i];
}
dev_dbg(ec_dev->dev, "packet: %*ph, sum = %02x\n",
i2c_msg[1].len, in_buf, sum);
if (sum != in_buf[2 + msg->insize]) {
if (sum != in_buf[2 + len]) {
dev_err(ec_dev->dev, "bad packet checksum\n");
ret = -EBADMSG;
goto done;
}
ret = i2c_msg[1].buf[1];
ret = len;
done:
kfree(in_buf);
kfree(out_buf);