Commit ae491542 authored by Dave Airlie's avatar Dave Airlie Committed by Dave Airlie
Browse files

drm/dp/mst: make mst i2c transfer code more robust. 



This zeroes the msg so no random stack data ends up getting
sent, it also limits the function to not accepting > 4
i2c msgs.

Cc: stable@vger.kernel.org
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent bc8c131c

drivers/gpu/drm/drm_dp_mst_topology.c

+2 −1
Original line number Diff line number Diff line
@@ -2801,12 +2801,13 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs 
	if (msgs[num - 1].flags & I2C_M_RD)

		reading = true;



	if (!reading) {

	if (!reading || (num - 1 > DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)) {

		DRM_DEBUG_KMS("Unsupported I2C transaction for MST device\n");

		ret = -EIO;

		goto out;

	}



	memset(&msg, 0, sizeof(msg));

	msg.req_type = DP_REMOTE_I2C_READ;

	msg.u.i2c_read.num_transactions = num - 1;

	msg.u.i2c_read.port_number = port->port_num;

include/drm/drm_dp_mst_helper.h

+2 −1
Original line number Diff line number Diff line
@@ -253,6 +253,7 @@ struct drm_dp_remote_dpcd_write { 
	u8 *bytes;

};



#define DP_REMOTE_I2C_READ_MAX_TRANSACTIONS 4

struct drm_dp_remote_i2c_read {

	u8 num_transactions;

	u8 port_number;
@@ -262,7 +263,7 @@ struct drm_dp_remote_i2c_read { 
		u8 *bytes;

		u8 no_stop_bit;

		u8 i2c_transaction_delay;

	} transactions[4];

	} transactions[DP_REMOTE_I2C_READ_MAX_TRANSACTIONS];

	u8 read_i2c_device_id;

	u8 num_bytes_read;

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE