cec_read() uses a two-message I2C transfer to select a register and read
its value. i2c_transfer() returns a negative errno or the number of
messages executed. A short transfer can therefore return zero or one
without writing the second message's buffer.
The current negative-only check treats that as success and returns an
uninitialized stack byte. The value may then affect register
read-modify-write operations, interrupt and HPD handling, or connector
detection.
Require both messages to complete before using the byte. Preserve the
existing zero fallback for failed reads.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 14e5b5889d75 ("drm/i2c: tda998x: allow sharing of the CEC device accesses")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
drivers/gpu/drm/bridge/tda998x_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/tda998x_drv.c b/drivers/gpu/drm/bridge/tda998x_drv.c
index 6c427bc75896b..7e82c918277fa 100644
--- a/drivers/gpu/drm/bridge/tda998x_drv.c
+++ b/drivers/gpu/drm/bridge/tda998x_drv.c
@@ -438,7 +438,7 @@ cec_read(struct tda998x_priv *priv, u8 addr)
int ret;
ret = i2c_transfer(priv->hdmi->adapter, msg, ARRAY_SIZE(msg));
- if (ret < 0) {
+ if (ret != ARRAY_SIZE(msg)) {
dev_err(&priv->hdmi->dev, "Error %d reading from cec:0x%x\n",
ret, addr);
val = 0;
--
2.51.0