When issuing 'i2c probe', the driver was crashing, because at probe there is a request with zero length buffer to write to i2c bus. The xfer_msg function assumes the buffer is always there, and never checks for the buffer length.
=> i2c dev 0 Setting bus to 0 => i2c probe Valid chip addresses: data abort pc : [<7ffa97dc>] lr : [<7ffa96f8>] reloc pc : [<66f277dc>] lr : [<66f276f8>] sp : 7fb7c110 ip : 7ff87a28 fp : 7ff99938 r10: 00000002 r9 : 7fb7dec0 r8 : 00000000 r7 : e181c600 r6 : 7fb88c20 r5 : 00000000 r4 : 7fb7c128 r3 : 00000000 r2 : 00000001 r1 : 00000000 r0 : 00000009 Flags: nZCv IRQs off FIQs off Mode SVC_32 Code: eb0092f4 e1a00005 e8bd81f0 e594300c (e5d33000) Resetting CPU ...
Fixes: 8800e0fa20 ("i2c: atmel: add i2c driver") Signed-off-by: Eugen Hristev eugen.hristev@microchip.com --- drivers/i2c/at91_i2c.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/i2c/at91_i2c.c b/drivers/i2c/at91_i2c.c index 9d6c6d80e2..dfd649cd57 100644 --- a/drivers/i2c/at91_i2c.c +++ b/drivers/i2c/at91_i2c.c @@ -50,6 +50,10 @@ static int at91_i2c_xfer_msg(struct at91_i2c_bus *bus, struct i2c_msg *msg) u32 i; int ret = 0;
+ /* if there is no message to send/receive, just exit quietly */ + if (msg->len == 0) + return ret; + readl(®->sr); if (is_read) { writel(TWI_CR_START, ®->cr);