[PATCH] media: solo6x10: Initialize I2C read data

[PATCH] media: solo6x10: Initialize I2C read data

[Ruoyu Wang]

solo_i2c_readbyte() ignores the number of messages completed by
i2c_transfer(). If the transfer stops before the read message completes,
the adapter returns a short count without storing anything in data. The
helper then returns an uninitialized stack byte, so chip detection and
user-visible control and status reads can consume unpredictable values.

The helper returns a byte and has no error channel. Preserve that API and
initialize data to zero as a deterministic fallback. Successful reads
still overwrite it, while failed or partial transfers no longer expose
indeterminate stack contents.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: faa4fd2a0951 ("Staging: solo6x10: New driver (staging) for Softlogic 6x10")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/media/pci/solo6x10/solo6x10-i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/solo6x10/solo6x10-i2c.c b/drivers/media/pci/solo6x10/solo6x10-i2c.c
index 7db785e9c99791..1b37dccd137a05 100644
--- a/drivers/media/pci/solo6x10/solo6x10-i2c.c
+++ b/drivers/media/pci/solo6x10/solo6x10-i2c.c
@@ -25,7 +25,7 @@
 u8 solo_i2c_readbyte(struct solo_dev *solo_dev, int id, u8 addr, u8 off)
 {
 	struct i2c_msg msgs[2];
-	u8 data;
+	u8 data = 0;
 
 	msgs[0].flags = 0;
 	msgs[0].addr = addr;
-- 
2.51.0

Re: [PATCH] media: solo6x10: Initialize I2C read data

[Ismael Luceno]

On 13/Aug/2026 23:31, Ruoyu Wang wrote:
> solo_i2c_readbyte() ignores the number of messages completed by
> i2c_transfer(). If the transfer stops before the read message completes,
> the adapter returns a short count without storing anything in data. The
> helper then returns an uninitialized stack byte, so chip detection and
> user-visible control and status reads can consume unpredictable values.
> 
> The helper returns a byte and has no error channel. Preserve that API and
> initialize data to zero as a deterministic fallback. Successful reads
> still overwrite it, while failed or partial transfers no longer expose
> indeterminate stack contents.
> 
> This issue was found by a static analysis checker and confirmed by manual
> source review.
> 
> Fixes: faa4fd2a0951 ("Staging: solo6x10: New driver (staging) for Softlogic 6x10")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>  drivers/media/pci/solo6x10/solo6x10-i2c.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/solo6x10/solo6x10-i2c.c b/drivers/media/pci/solo6x10/solo6x10-i2c.c
> index 7db785e9c99791..1b37dccd137a05 100644
> --- a/drivers/media/pci/solo6x10/solo6x10-i2c.c
> +++ b/drivers/media/pci/solo6x10/solo6x10-i2c.c
> @@ -25,7 +25,7 @@
>  u8 solo_i2c_readbyte(struct solo_dev *solo_dev, int id, u8 addr, u8 off)
>  {
>  	struct i2c_msg msgs[2];
> -	u8 data;
> +	u8 data = 0;
>  
>  	msgs[0].flags = 0;
>  	msgs[0].addr = addr;
> -- 
> 2.51.0
> 

Nacked-by: Ismael Luceno <ismael@iodev.co.uk>

There's no guarantee that the buffer would remain zero on an error
condition.

But even then returning a zero on error here is a bad idea, the
interface needs some change.