From: "Zhou,Junde" <zhoujd@xxxxxxxxxxx> do parameter checking in drivers/i2c/i2c-core-smbus.c. return -EINVAL when input parameter length is equal to 0. Signed-off-by: Zhou,Junde <zhoujd@xxxxxxxxxxx> --- drivers/i2c/i2c-core-smbus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c index e5b2d1465e7e..9fbc96be6958 100644 --- a/drivers/i2c/i2c-core-smbus.c +++ b/drivers/i2c/i2c-core-smbus.c @@ -254,6 +254,8 @@ s32 i2c_smbus_write_block_data(const struct i2c_client *client, u8 command, if (length > I2C_SMBUS_BLOCK_MAX) length = I2C_SMBUS_BLOCK_MAX; + if (length == 0) + return -EINVAL; data.block[0] = length; memcpy(&data.block[1], values, length); return i2c_smbus_xfer(client->adapter, client->addr, client->flags, @@ -271,6 +273,8 @@ s32 i2c_smbus_read_i2c_block_data(const struct i2c_client *client, u8 command, if (length > I2C_SMBUS_BLOCK_MAX) length = I2C_SMBUS_BLOCK_MAX; + if (length == 0) + return -EINVAL; data.block[0] = length; status = i2c_smbus_xfer(client->adapter, client->addr, client->flags, I2C_SMBUS_READ, command, @@ -290,6 +294,8 @@ s32 i2c_smbus_write_i2c_block_data(const struct i2c_client *client, u8 command, if (length > I2C_SMBUS_BLOCK_MAX) length = I2C_SMBUS_BLOCK_MAX; + if (length == 0) + return -EINVAL; data.block[0] = length; memcpy(data.block + 1, values, length); return i2c_smbus_xfer(client->adapter, client->addr, client->flags, -- 2.25.1
