[PATCH v2 2/3] Input: ilitek_ts: handle short I2C transfers
From: Kristian Mide
Date: Thu Jul 09 2026 - 14:27:16 EST
Check that i2c_transfer() returns the expected number of
messages in ilitek_i2c_write_and_read().
Short transfers were previously treated as success, allowing
callers to continue with partially filled buffers. In the report
path that can expose uninitialized stack data through debugging
output and can also confuse packet parsing.
---
drivers/input/touchscreen/ilitek_ts_i2c.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/input/touchscreen/ilitek_ts_i2c.c b/drivers/input/touchscreen/ilitek_ts_i2c.c
index 54e39721f..6146baa2b 100644
--- a/drivers/input/touchscreen/ilitek_ts_i2c.c
+++ b/drivers/input/touchscreen/ilitek_ts_i2c.c
@@ -131,11 +131,15 @@ static int ilitek_i2c_write_and_read(struct ilitek_ts_data *ts,
error = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
if (error < 0)
return error;
+ if (error != ARRAY_SIZE(msgs))
+ return -EIO;
} else {
if (write_len > 0) {
error = i2c_transfer(client->adapter, msgs, 1);
if (error < 0)
return error;
+ if (error != 1)
+ return -EIO;
}
if (delay > 0)
fsleep(delay * 1000);
@@ -144,6 +148,8 @@ static int ilitek_i2c_write_and_read(struct ilitek_ts_data *ts,
error = i2c_transfer(client->adapter, msgs + 1, 1);
if (error < 0)
return error;
+ if (error != 1)
+ return -EIO;
}
}
--
2.54.0