Skip to contentSkip to conversation

i2c: at91: add a sanity check on i2c message length

PATCH New ludovic.desroches at atmel.com 3 participants 8 messages Oct 10, 2012 – Nov 5, 2012

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

---

fix for 3.7

 drivers/i2c/busses/i2c-at91.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-at91.c +3 -0
index aa59a25..eaddc77 100644
@@ -263,6 +263,9 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
 	unsigned int_addr_flag = 0;
 	struct i2c_msg *m_start = msg;
 
+	if (!msg->len)
+		return -EINVAL;
+
 	dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num);
 
 	/*
Signature · 1 line
1.7.11.3
#1 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

Hi Wolfram,

Le 10/10/2012 04:25 PM, ludovic.desroches at atmel.com a ?crit :

Quoted 19 lines

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

---

fix for 3.7

  drivers/i2c/busses/i2c-at91.c | 3 +++
  1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-at91.c +0 -0
index aa59a25..eaddc77 100644

drivers/i2c/busses/i2c-at91.c static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num) · line 271

Quoted 9 lines
drivers/i2c/busses/i2c-at91.c +3 -0
@@ -263,6 +263,9 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
  	unsigned int_addr_flag = 0;
  	struct i2c_msg *m_start = msg;
 
+	if (!msg->len)
+		return -EINVAL;
+
  	dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num);
 
  	/*

Could you take this fix for 3.7?

Thanks

Regards

Ludovic

#2 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

In reply to ludovic.desroches at atmel.com
Quoted 6 lines · ludovic.desroches at atmel.com

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

What happens if you send a 0 byte message? Some hardware is able to do this and it will be used in SMBUS QUICK which the driver states to support according to at91_twi_func().

Regards,

Wolfram

Signature · 9 lines
Pengutronix e.K.                           | Wolfram Sang                |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20121101/f5d6d91d/attachment.sig>
#3 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

Hi Wolfram,

Le 11/01/2012 11:29 PM, Wolfram Sang a ?crit :

Quoted 11 lines · ludovic.desroches at atmel.com
Quoted 6 lines

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

What happens if you send a 0 byte message? Some hardware is able to do this and it will be used in SMBUS QUICK which the driver states to support according to at91_twi_func().

Without this I had some data corruption when writing to / reading from a serial eeprom (depending on the IP version).

Yes SMBUS quick command is supported but is not managed in the driver, we have to tell explicitly the IP that we want to send this command.

Regards

Ludovic

Quoted 5 lines

Regards,

Wolfram

#4 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

Quoted 15 lines · ludovic.desroches

Hi Wolfram,

Le 11/01/2012 11:29 PM, Wolfram Sang a ?crit :

Quoted 11 lines · ludovic.desroches at atmel.com
Quoted 6 lines

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

What happens if you send a 0 byte message? Some hardware is able to do this and it will be used in SMBUS QUICK which the driver states to support according to at91_twi_func().

Quoted 6 lines

Without this I had some data corruption when writing to / reading from a serial eeprom (depending on the IP version).

Yes SMBUS quick command is supported but is not managed in the driver, we have to tell explicitly the IP that we want to send this command.

Ok, so unless you want to implement the support, please update this patch with a comment that SMBUS_QUICK is a TODO and remove the SMBUS_QUICK capability.

Signature · 9 lines
Pengutronix e.K.                           | Wolfram Sang                |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20121102/48709ea9/attachment-0001.sig>
#5 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

Le 11/02/2012 12:14 PM, Wolfram Sang a ?crit :

Quoted 19 lines · ludovic.desroches
Quoted 18 lines

Hi Wolfram,

Le 11/01/2012 11:29 PM, Wolfram Sang a ?crit :

Quoted 11 lines · ludovic.desroches at atmel.com
Quoted 6 lines

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

What happens if you send a 0 byte message? Some hardware is able to do this and it will be used in SMBUS QUICK which the driver states to support according to at91_twi_func().

Without this I had some data corruption when writing to / reading from a serial eeprom (depending on the IP version).

Quoted 8 lines
Quoted 3 lines

Yes SMBUS quick command is supported but is not managed in the driver, we have to tell explicitly the IP that we want to send this command.

Ok, so unless you want to implement the support, please update this patch with a comment that SMBUS_QUICK is a TODO and remove the SMBUS_QUICK capability.

Implementation should not be a huge task, only one bit to set in a register but I have no device to test it.
So I will choose to remove the SMBUS_QUICK capability.

Hi Nikolaus,

Did you test the driver with SMBus compatible devices? Can I keep other SMBus capabilities from SMBUS_EMUL?

Thanks

Regards

Ludovic

#6 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

Quoted 5 lines
Quoted 5 lines
Quoted 4 lines

Yes SMBUS quick command is supported but is not managed in the driver, we have to tell explicitly the IP that we want to send this command.

Quoted 7 lines
Quoted 4 lines

Ok, so unless you want to implement the support, please update this patch with a comment that SMBUS_QUICK is a TODO and remove the SMBUS_QUICK capability.

Implementation should not be a huge task, only one bit to set in a register but I have no device to test it.

'i2cdetect' from i2c-tools uses SMBUS_QUICK as one method to detect chips. Most slaves (both I2C and SMBus) react to that, so that would do in my book.

Quoted 2 lines

Did you test the driver with SMBus compatible devices? Can I keep other SMBus capabilities from SMBUS_EMUL?

The rest should be fine.

Signature · 9 lines
Pengutronix e.K.                           | Wolfram Sang                |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20121103/b3b8259b/attachment.sig>
#7 lore raw

PATCH 1/1 i2c: at91: add a sanity check on i2c message length

In reply to ludovic.desroches

ludovic.desroches wrote on Friday, November 02, 2012 5:01 PM:

Quoted 31 lines

Le 11/02/2012 12:14 PM, Wolfram Sang a ?crit :

Quoted 5 lines · ludovic.desroches
Quoted 4 lines

Hi Wolfram,

Le 11/01/2012 11:29 PM, Wolfram Sang a ?crit :

Quoted 1 line

On Wed, Oct 10, 2012 at 04:25:58PM +0200,

Quoted 8 lines · ludovic.desroches at atmel.com
Quoted 8 lines
Quoted 8 lines
Quoted 6 lines

From: Ludovic Desroches <[email protected]>

If the i2c message length is zero, i2c-at91 will directly return an error instead of trying to send a zero-length message.

What happens if you send a 0 byte message? Some hardware is able to

do

Quoted 6 lines
Quoted 6 lines
Quoted 2 lines

this and it will be used in SMBUS QUICK which the driver states to support according to at91_twi_func().

Without this I had some data corruption when writing to / reading from a serial eeprom (depending on the IP version).

Quoted 8 lines
Quoted 3 lines

Yes SMBUS quick command is supported but is not managed in the driver, we have to tell explicitly the IP that we want to send this command.

Ok, so unless you want to implement the support, please update this patch with a comment that SMBUS_QUICK is a TODO and remove the SMBUS_QUICK capability.

Quoted 8 lines

Implementation should not be a huge task, only one bit to set in a register but I have no device to test it.
So I will choose to remove the SMBUS_QUICK capability.

Hi Nikolaus,

Did you test the driver with SMBus compatible devices? Can I keep other SMBus capabilities from SMBUS_EMUL?

Hi Ludovic,

yes, I use this driver with the sbs driver to query a smbus-attached battery with a TI bq chip (I actually wrote this driver only for this purpose). I implemented and tested SMBUS_BLOCK but not SMBUS_QUICK...

Niko