i2c: i801: Don't silently correct invalid transfer size

[ Upstream commit effa453168a7eeb8a562ff4edc1dbf9067360a61 ]

If an invalid block size is provided, reject it instead of silently
changing it to a supported value. Especially critical I see the case of
a write transfer with block length 0. In this case we have no guarantee
that the byte we would write is valid. When silently reducing a read to
32 bytes then we don't return an error and the caller may falsely
assume that we returned the full requested data.

If this change should break any (broken) caller, then I think we should
fix the caller.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 0e04b27e3158db01f30e70444451b38e9c313f95..b577c64f3b3ecd01f6b2e07b382668c6d3303f7a 100644 (file)
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -762,6 +762,11 @@ static int i801_block_transaction(struct i801_priv *priv,
        int result = 0;
        unsigned char hostc;
 
+       if (read_write == I2C_SMBUS_READ && command == I2C_SMBUS_BLOCK_DATA)
+               data->block[0] = I2C_SMBUS_BLOCK_MAX;
+       else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX)
+               return -EPROTO;
+
        if (command == I2C_SMBUS_I2C_BLOCK_DATA) {
                if (read_write == I2C_SMBUS_WRITE) {
                        /* set I2C_EN bit in configuration register */
@@ -775,16 +780,6 @@ static int i801_block_transaction(struct i801_priv *priv,
                }
        }
 
-       if (read_write == I2C_SMBUS_WRITE
-        || command == I2C_SMBUS_I2C_BLOCK_DATA) {
-               if (data->block[0] < 1)
-                       data->block[0] = 1;
-               if (data->block[0] > I2C_SMBUS_BLOCK_MAX)
-                       data->block[0] = I2C_SMBUS_BLOCK_MAX;
-       } else {
-               data->block[0] = 32;    /* max for SMBus block reads */
-       }
-
        /* Experience has shown that the block buffer can only be used for
           SMBus (not I2C) block transactions, even though the datasheet
           doesn't mention this limitation. */