diff options
| author | Aaron Durbin <adurbin@chromium.org> | 2014-08-12 22:49:21 -0500 |
|---|---|---|
| committer | chrome-internal-fetch <chrome-internal-fetch@google.com> | 2014-08-14 15:29:35 +0000 |
| commit | 80f5d9e10a04f3fc4234fce304ba742aee16c1f9 (patch) | |
| tree | b78f74daf5fe9105b527121d075fc0a66ac304be | |
| parent | 0c635cc73e0926ff0c94d31c39e1b30da54bc8e9 (diff) | |
| download | chrome-ec-80f5d9e10a04f3fc4234fce304ba742aee16c1f9.tar.gz | |
stm32f0: always initialize i2c_packet
The i2c_packet structure wasn't always being initialized
in the error path. It's possible to crash the EC if the first
command processed hit this error path. Instead, unconditionally
set all the i2c_packet fields.
BUG=chrome-os-partner:30784
BRANCH=None
TEST=Built and ran on ryu.
Change-Id: Ic6d7c63f61d59c4449fbb20f656c1bfb835db8be
Signed-off-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/212164
Reviewed-by: Alec Berg <alecaberg@chromium.org>
| -rw-r--r-- | chip/stm32/i2c-stm32f0.c | 28 |
1 files changed, 14 insertions, 14 deletions
diff --git a/chip/stm32/i2c-stm32f0.c b/chip/stm32/i2c-stm32f0.c index b3508ead1b..1a289393d4 100644 --- a/chip/stm32/i2c-stm32f0.c +++ b/chip/stm32/i2c-stm32f0.c @@ -166,23 +166,23 @@ static void i2c_process_command(void) * host command i2c process function which handles all protocol * versions. */ - if (*buff >= EC_COMMAND_PROTOCOL_3) { - i2c_packet.send_response = i2c_send_response_packet; + i2c_packet.send_response = i2c_send_response_packet; - i2c_packet.request = (const void *)(&buff[1]); - i2c_packet.request_temp = params_copy; - i2c_packet.request_max = sizeof(params_copy); - /* Don't know the request size so pass in the entire buffer */ - i2c_packet.request_size = I2C_MAX_HOST_PACKET_SIZE; + i2c_packet.request = (const void *)(&buff[1]); + i2c_packet.request_temp = params_copy; + i2c_packet.request_max = sizeof(params_copy); + /* Don't know the request size so pass in the entire buffer */ + i2c_packet.request_size = I2C_MAX_HOST_PACKET_SIZE; - /* - * Stuff response at buff[2] to leave the first two bytes of - * buffer available for the result and size to send over i2c. - */ - i2c_packet.response = (void *)(&buff[2]); - i2c_packet.response_max = I2C_MAX_HOST_PACKET_SIZE; - i2c_packet.response_size = 0; + /* + * Stuff response at buff[2] to leave the first two bytes of + * buffer available for the result and size to send over i2c. + */ + i2c_packet.response = (void *)(&buff[2]); + i2c_packet.response_max = I2C_MAX_HOST_PACKET_SIZE; + i2c_packet.response_size = 0; + if (*buff >= EC_COMMAND_PROTOCOL_3) { i2c_packet.driver_result = EC_RES_SUCCESS; } else { /* Only host command protocol 3 is supported. */ |