[PATCH V3 1/2] i2c: imx: preserve error state in block data length handler

LI Qingwu
2026-01-16T11:19:15Z

When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,
the length handler sets the state to IMX_I2C_STATE_FAILED. However,
i2c_imx_master_isr() unconditionally overwrites this with
IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns
buffers and crashes the system.

Guard the state transition to preserve error states set by the length
handler.

Signed-off-by: LI Qingwu <Qing-wu.Li@leica-geosystems.com.cn>
---
drivers/i2c/busses/i2c-imx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 205cc132fdec..05ba41144648 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1102,7 +1102,8 @@ static irqreturn_t i2c_imx_master_isr(struct imx_i2c_struct *i2c_imx, unsigned i

case IMX_I2C_STATE_READ_BLOCK_DATA_LEN:
i2c_imx_isr_read_block_data_len(i2c_imx);
- i2c_imx->state = IMX_I2C_STATE_READ_CONTINUE;
+ if (i2c_imx->state == IMX_I2C_STATE_READ_BLOCK_DATA_LEN)
+ i2c_imx->state = IMX_I2C_STATE_READ_CONTINUE;
break;

case IMX_I2C_STATE_WRITE:
--
2.43.0