Commit cb8ce711 authored by Ville Syrjälä's avatar Ville Syrjälä
Browse files

drm/dp/mst: Validate REMOTE_I2C_READ harder 



Make sure i2c msgs we're asked to transfer conform to the
requirements of REMOTE_I2C_READ. We were only checking that the
last message is a read, but we must also check that the preceding
messages are all writes. Also check that the length of each
message isn't too long.

Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180928180403.22499-2-ville.syrjala@linux.intel.com


Reviewed-by: default avatarDhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
parent c978ae9b

drivers/gpu/drm/drm_dp_mst_topology.c

+18 −7
Original line number Original line Diff line number Diff line
@@ -3250,6 +3250,23 @@ void drm_dp_mst_topology_mgr_destroy(struct drm_dp_mst_topology_mgr *mgr) 
}

}

EXPORT_SYMBOL(drm_dp_mst_topology_mgr_destroy);

EXPORT_SYMBOL(drm_dp_mst_topology_mgr_destroy);





static bool remote_i2c_read_ok(const struct i2c_msg msgs[], int num)

{

	int i;



	if (num - 1 > DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)

		return false;



	for (i = 0; i < num - 1; i++) {

		if (msgs[i].flags & I2C_M_RD ||

		    msgs[i].len > 0xff)

			return false;

	}



	return msgs[num - 1].flags & I2C_M_RD &&

		msgs[num - 1].len <= 0xff;

}



/* I2C device */

/* I2C device */

static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,

static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,

			       int num)

			       int num)
@@ -3259,7 +3276,6 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs 
	struct drm_dp_mst_branch *mstb;

	struct drm_dp_mst_branch *mstb;

	struct drm_dp_mst_topology_mgr *mgr = port->mgr;

	struct drm_dp_mst_topology_mgr *mgr = port->mgr;

	unsigned int i;

	unsigned int i;

	bool reading = false;

	struct drm_dp_sideband_msg_req_body msg;

	struct drm_dp_sideband_msg_req_body msg;

	struct drm_dp_sideband_msg_tx *txmsg = NULL;

	struct drm_dp_sideband_msg_tx *txmsg = NULL;

	int ret;

	int ret;
@@ -3268,12 +3284,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs 
	if (!mstb)

	if (!mstb)

		return -EREMOTEIO;

		return -EREMOTEIO;





	/* construct i2c msg */

	if (!remote_i2c_read_ok(msgs, num)) {

	/* see if last msg is a read */

	if (msgs[num - 1].flags & I2C_M_RD)

		reading = true;



	if (!reading || (num - 1 > DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)) {

		DRM_DEBUG_KMS("Unsupported I2C transaction for MST device\n");

		DRM_DEBUG_KMS("Unsupported I2C transaction for MST device\n");

		ret = -EIO;

		ret = -EIO;

		goto out;

		goto out;

CRA Git | Maintained and supported by SUSTech CRA and CCSE