Skip to content

Commit 8bff946

Browse files
author
Tzung-Bi Shih
committed
platform/chrome: cros_ec_i2c: drop BUG_ON() in cros_ec_pkt_xfer_i2c()
It is overkill to crash the kernel if the given message is oversize. Drop the BUG_ON() and return -EINVAL instead. Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Tzung-Bi Shih <[email protected]> Link: https://lore.kernel.org/r/[email protected]
1 parent 20a264c commit 8bff946

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

drivers/platform/chrome/cros_ec_i2c.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,13 +72,19 @@ static int cros_ec_pkt_xfer_i2c(struct cros_ec_device *ec_dev,
7272
i2c_msg[1].flags = I2C_M_RD;
7373

7474
packet_len = msg->insize + response_header_size;
75-
BUG_ON(packet_len > ec_dev->din_size);
75+
if (packet_len > ec_dev->din_size) {
76+
ret = -EINVAL;
77+
goto done;
78+
}
7679
in_buf = ec_dev->din;
7780
i2c_msg[1].len = packet_len;
7881
i2c_msg[1].buf = (char *) in_buf;
7982

8083
packet_len = msg->outsize + request_header_size;
81-
BUG_ON(packet_len > ec_dev->dout_size);
84+
if (packet_len > ec_dev->dout_size) {
85+
ret = -EINVAL;
86+
goto done;
87+
}
8288
out_buf = ec_dev->dout;
8389
i2c_msg[0].len = packet_len;
8490
i2c_msg[0].buf = (char *) out_buf;

0 commit comments

Comments
 (0)