Skip to content

Commit bbd43a3

Browse files
author
Tzung-Bi Shih
committed
platform/chrome: cros_ec_spi: drop BUG_ON() if din isn't large enough
It is overkill to crash the kernel if the `din` buffer is going to full or overflow. Drop the BUG_ON() and return -EINVAL instead. Signed-off-by: Tzung-Bi Shih <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Link: https://lore.kernel.org/r/[email protected]
1 parent ddec8e9 commit bbd43a3

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

drivers/platform/chrome/cros_ec_spi.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,8 @@ static int receive_n_bytes(struct cros_ec_device *ec_dev, u8 *buf, int n)
160160
struct spi_message msg;
161161
int ret;
162162

163-
BUG_ON(buf - ec_dev->din + n > ec_dev->din_size);
163+
if (buf - ec_dev->din + n > ec_dev->din_size)
164+
return -EINVAL;
164165

165166
memset(&trans, 0, sizeof(trans));
166167
trans.cs_change = 1;
@@ -197,7 +198,8 @@ static int cros_ec_spi_receive_packet(struct cros_ec_device *ec_dev,
197198
unsigned long deadline;
198199
int todo;
199200

200-
BUG_ON(ec_dev->din_size < EC_MSG_PREAMBLE_COUNT);
201+
if (ec_dev->din_size < EC_MSG_PREAMBLE_COUNT)
202+
return -EINVAL;
201203

202204
/* Receive data until we see the header byte */
203205
deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);
@@ -304,7 +306,8 @@ static int cros_ec_spi_receive_response(struct cros_ec_device *ec_dev,
304306
unsigned long deadline;
305307
int todo;
306308

307-
BUG_ON(ec_dev->din_size < EC_MSG_PREAMBLE_COUNT);
309+
if (ec_dev->din_size < EC_MSG_PREAMBLE_COUNT)
310+
return -EINVAL;
308311

309312
/* Receive data until we see the header byte */
310313
deadline = jiffies + msecs_to_jiffies(EC_MSG_DEADLINE_MS);

0 commit comments

Comments
 (0)