| From 56350fb8978bbf4aafe08f21234e161dd128b417 Mon Sep 17 00:00:00 2001 |
| From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> |
| Date: Thu, 23 Nov 2017 21:41:57 +0200 |
| Subject: drm/i915: Prevent zero length "index" write |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Ville Syrjälä <ville.syrjala@linux.intel.com> |
| |
| commit 56350fb8978bbf4aafe08f21234e161dd128b417 upstream. |
| |
| The hardware always writes one or two bytes in the index portion of |
| an indexed transfer. Make sure the message we send as the index |
| doesn't have a zero length. |
| |
| Cc: Daniel Kurtz <djkurtz@chromium.org> |
| Cc: Chris Wilson <chris@chris-wilson.co.uk> |
| Cc: Daniel Vetter <daniel.vetter@ffwll.ch> |
| Cc: Sean Paul <seanpaul@chromium.org> |
| Fixes: 56f9eac05489 ("drm/i915/intel_i2c: use INDEX cycles for i2c read transactions") |
| Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> |
| Link: https://patchwork.freedesktop.org/patch/msgid/20171123194157.25367-3-ville.syrjala@linux.intel.com |
| Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> |
| (cherry picked from commit bb9e0d4bca50f429152e74a459160b41f3d60fb2) |
| Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/gpu/drm/i915/intel_i2c.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/gpu/drm/i915/intel_i2c.c |
| +++ b/drivers/gpu/drm/i915/intel_i2c.c |
| @@ -441,7 +441,8 @@ gmbus_is_index_read(struct i2c_msg *msgs |
| { |
| return (i + 1 < num && |
| msgs[i].addr == msgs[i + 1].addr && |
| - !(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 && |
| + !(msgs[i].flags & I2C_M_RD) && |
| + (msgs[i].len == 1 || msgs[i].len == 2) && |
| (msgs[i + 1].flags & I2C_M_RD)); |
| } |
| |
