From 73c16692bcf7505d01596f48d2006dadfa3d14ab Mon Sep 17 00:00:00 2001 From: Eugen Hristev Date: Fri, 4 Dec 2020 18:06:55 +0200 Subject: [PATCH] i2c: at91: fix crash when using 'i2c probe' When issuing 'i2c probe', the driver was crashing, because at probe there is a request with zero length buffer to write to i2c bus. The xfer_msg function assumes the buffer is always there, and never checks for the buffer length. => i2c dev 0 Setting bus to 0 => i2c probe Valid chip addresses: data abort pc : [<7ffa97dc>] lr : [<7ffa96f8>] reloc pc : [<66f277dc>] lr : [<66f276f8>] sp : 7fb7c110 ip : 7ff87a28 fp : 7ff99938 r10: 00000002 r9 : 7fb7dec0 r8 : 00000000 r7 : e181c600 r6 : 7fb88c20 r5 : 00000000 r4 : 7fb7c128 r3 : 00000000 r2 : 00000001 r1 : 00000000 r0 : 00000009 Flags: nZCv IRQs off FIQs off Mode SVC_32 Code: eb0092f4 e1a00005 e8bd81f0 e594300c (e5d33000) Resetting CPU ... Fixes: 8800e0fa20 ("i2c: atmel: add i2c driver") Signed-off-by: Eugen Hristev --- drivers/i2c/at91_i2c.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/i2c/at91_i2c.c b/drivers/i2c/at91_i2c.c index aca8de9436..6b4c0e4804 100644 --- a/drivers/i2c/at91_i2c.c +++ b/drivers/i2c/at91_i2c.c @@ -51,6 +51,10 @@ static int at91_i2c_xfer_msg(struct at91_i2c_bus *bus, struct i2c_msg *msg) u32 i; int ret = 0; + /* if there is no message to send/receive, just exit quietly */ + if (msg->len == 0) + return ret; + readl(®->sr); if (is_read) { writel(TWI_CR_START, ®->cr);