The return value from itg3200_read_reg_s16() is stored in ret but
never checked. The function unconditionally returns IIO_VAL_INT,
ignoring potential I2C read failures. This causes garbage data to
be returned to userspace when the read fails, with no error reported.

Add proper error checking to propagate the failure to callers.

Fixes: 9dbf091da080 ("iio: gyro: Add itg3200")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
---
 drivers/iio/gyro/itg3200_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/gyro/itg3200_core.c b/drivers/iio/gyro/itg3200_core.c
index cd8a2dae56cd..bfe95ec1abda 100644
--- a/drivers/iio/gyro/itg3200_core.c
+++ b/drivers/iio/gyro/itg3200_core.c
@@ -93,6 +93,8 @@ static int itg3200_read_raw(struct iio_dev *indio_dev,
 	case IIO_CHAN_INFO_RAW:
 		reg = (u8)chan->address;
 		ret = itg3200_read_reg_s16(indio_dev, reg, val);
+		if (ret)
+			return ret;
 		return IIO_VAL_INT;
 	case IIO_CHAN_INFO_SCALE:
 		*val = 0;
-- 
2.43.0

On Thu, Jan 29, 2026 at 05:01:45PM +0200, Antoniu Miclaus wrote:
> The return value from itg3200_read_reg_s16() is stored in ret but
> never checked. The function unconditionally returns IIO_VAL_INT,
> ignoring potential I2C read failures. This causes garbage data to
> be returned to userspace when the read fails, with no error reported.

> Add proper error checking to propagate the failure to callers.

Yeah, but when it's not a series do not use --thread!
(P.S. do not resend, it's for the future now)

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

On Thu, 29 Jan 2026 17:53:22 +0200
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Thu, Jan 29, 2026 at 05:01:45PM +0200, Antoniu Miclaus wrote:
> > The return value from itg3200_read_reg_s16() is stored in ret but
> > never checked. The function unconditionally returns IIO_VAL_INT,
> > ignoring potential I2C read failures. This causes garbage data to
> > be returned to userspace when the read fails, with no error reported.  
> 
> > Add proper error checking to propagate the failure to callers.  
> 
> Yeah, but when it's not a series do not use --thread!
> (P.S. do not resend, it's for the future now)
> 
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> 
Applied this patch to the togreg branch of iio.git (given nearness
of merge window) and marked for stable.

The i2c_transfer() function returns the number of messages
successfully transferred. The function sends 1 message but checks
for ret == 2, which can never be true. This causes the function to
always return an error (1) instead of success (0).

Fix the check to compare against the actual number of messages sent.

Fixes: 6362d96585e3 ("iio: pressure: driver for Honeywell HSC/SSC series")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
---
 drivers/iio/pressure/hsc030pa_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/pressure/hsc030pa_i2c.c b/drivers/iio/pressure/hsc030pa_i2c.c
index a34ef4653f34..e780732c7b75 100644
--- a/drivers/iio/pressure/hsc030pa_i2c.c
+++ b/drivers/iio/pressure/hsc030pa_i2c.c
@@ -35,7 +35,7 @@ static int hsc_i2c_recv(struct hsc_data *data)
 
 	ret = i2c_transfer(client->adapter, &msg, 1);
 
-	return (ret == 2) ? 0 : ret;
+	return (ret == 1) ? 0 : ret;
 }
 
 static int hsc_i2c_probe(struct i2c_client *client)
-- 
2.43.0

On Thu, 29 Jan 2026 17:01:46 +0200
Antoniu Miclaus <antoniu.miclaus@analog.com> wrote:

> The i2c_transfer() function returns the number of messages
> successfully transferred. The function sends 1 message but checks
> for ret == 2, which can never be true. This causes the function to
> always return an error (1) instead of success (0).
> 
> Fix the check to compare against the actual number of messages sent.
> 
> Fixes: 6362d96585e3 ("iio: pressure: driver for Honeywell HSC/SSC series")
> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>

Not a bug with any impact because the check is on ret < 0
at the caller. 

So this commit message needs adjustment to reflect that - little
point in anyone backporting it as a result.

If it were ever other than 1 or zero we'd want to do something subtler and
even though that doesn't happen I'd write the code differently to reflect the different
potential outcomes
> ---
>  drivers/iio/pressure/hsc030pa_i2c.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/pressure/hsc030pa_i2c.c b/drivers/iio/pressure/hsc030pa_i2c.c
> index a34ef4653f34..e780732c7b75 100644
> --- a/drivers/iio/pressure/hsc030pa_i2c.c
> +++ b/drivers/iio/pressure/hsc030pa_i2c.c
> @@ -35,7 +35,7 @@ static int hsc_i2c_recv(struct hsc_data *data)
>  
>  	ret = i2c_transfer(client->adapter, &msg, 1);
>  
> -	return (ret == 2) ? 0 : ret;
> +	return (ret == 1) ? 0 : ret;
That is
	if (ret < 0)
		return ret;

	if (ret != 1)
		return -EIO;

	return 0;

>  }
>  
>  static int hsc_i2c_probe(struct i2c_client *client)

On Thu, Jan 29, 2026 at 05:01:46PM +0200, Antoniu Miclaus wrote:
> The i2c_transfer() function returns the number of messages
> successfully transferred. The function sends 1 message but checks
> for ret == 2, which can never be true. This causes the function to
> always return an error (1) instead of success (0).
> 
> Fix the check to compare against the actual number of messages sent.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko