[PATCH] Fix i.MX I2C driver zero byte read kernel panic

[PATCH] Fix i.MX I2C driver zero byte read kernel panic

[Krzysztof Hałasa]

Generally, zero-sized I2C read requests aren't valid. After START,
SDA line ownership is transferred to the slave device, and the master
cannot terminate transfer at this point.

Passing zero-sized read request to i.MX I2C driver causes a NULL pointer
dereference in i2c_imx_isr_read_continue() here:

i2c_imx->msg->buf[i2c_imx->msg_buf_idx++] = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);

Fix it by rejecting zero-sized read transfers.

Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>

diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index c44452449a75..1f0f72386912 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1637,7 +1637,9 @@ static int i2c_imx_xfer_common(struct i2c_adapter *adapter,
 		if (msgs[i].flags & I2C_M_RD) {
 			int block_data = msgs->flags & I2C_M_RECV_LEN;
 
-			if (atomic)
+			if (!msgs[i].len) /* invalid, would panic */
+				result = -EINVAL;
+			else if (atomic)
 				result = i2c_imx_atomic_read(i2c_imx, &msgs[i], is_lastmsg);
 			else if (use_dma && !block_data)
 				result = i2c_imx_dma_read(i2c_imx, &msgs[i], is_lastmsg);

-- 
Krzysztof "Chris" Hałasa

Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa