From khali@linux-fr.org Mon Sep 26 02:14:58 2005 Date: Sun, 25 Sep 2005 17:01:11 +0200 From: Jean Delvare To: Greg KH Cc: Hideki Iwamoto Subject: i2c: Several PEC-related fixes in software SMBus emulation Message-Id: <20050925170111.6a3d2ce7.khali@linux-fr.org> From: Hideki Iwamoto Fix several errors in I2C SMBus emulation when PEC is used: * Weird logic error in SMBus Write Word transactions. * Wrong buffer size, affecting SMBus Block Write transactions. * Potential buffer overrun in SMBus Block Write transactions. From: Hideki Iwamoto Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman drivers/i2c/i2c-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- --- gregkh-2.6.orig/drivers/i2c/i2c-core.c +++ gregkh-2.6/drivers/i2c/i2c-core.c @@ -864,7 +864,7 @@ static int i2c_smbus_add_pec(u16 addr, u break; case I2C_SMBUS_BYTE_DATA: buf[2] = data->byte; - data->word = buf[2] || + data->word = buf[2] | (i2c_smbus_pec(3, buf, NULL) << 8); size = I2C_SMBUS_WORD_DATA; break; @@ -1033,8 +1033,8 @@ static s32 i2c_smbus_xfer_emulated(struc need to use only one message; when reading, we need two. We initialize most things with sane defaults, to keep the code below somewhat simpler. */ - unsigned char msgbuf0[34]; - unsigned char msgbuf1[34]; + unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+3]; + unsigned char msgbuf1[I2C_SMBUS_BLOCK_MAX+2]; int num = read_write == I2C_SMBUS_READ?2:1; struct i2c_msg msg[2] = { { addr, flags, 1, msgbuf0 }, { addr, flags | I2C_M_RD, 0, msgbuf1 } @@ -1097,7 +1097,7 @@ static s32 i2c_smbus_xfer_emulated(struc } if(size == I2C_SMBUS_BLOCK_DATA_PEC) (msg[0].len)++; - for (i = 1; i <= msg[0].len; i++) + for (i = 1; i < msg[0].len; i++) msgbuf0[i] = data->block[i-1]; } break;