[PATCH] drm/dp/mst: make mst i2c transfer code more robust.

[Daniel Vetter]

On Wed, Oct 14, 2015 at 06:51:17PM +1000, Dave Airlie wrote:
> This zeroes the msg so no random stack data ends up getting
> sent, it also limits the function to not accepting > 4
> i2c msgs.
> 
> Cc: stable at vger.kernel.org
> Signed-off-by: Dave Airlie <airlied at redhat.com>

Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch>

> ---
>  drivers/gpu/drm/drm_dp_mst_topology.c | 3 ++-
>  include/drm/drm_dp_mst_helper.h       | 3 ++-
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
> index bf27a07..5bca390 100644
> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> @@ -2801,12 +2801,13 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
>  	if (msgs[num - 1].flags & I2C_M_RD)
>  		reading = true;
>  
> -	if (!reading) {
> +	if (!reading || (num - 1 > DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)) {
>  		DRM_DEBUG_KMS("Unsupported I2C transaction for MST device\n");
>  		ret = -EIO;
>  		goto out;
>  	}
>  
> +	memset(&msg, 0, sizeof(msg));
>  	msg.req_type = DP_REMOTE_I2C_READ;
>  	msg.u.i2c_read.num_transactions = num - 1;
>  	msg.u.i2c_read.port_number = port->port_num;
> diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
> index 0f408b0..5340099 100644
> --- a/include/drm/drm_dp_mst_helper.h
> +++ b/include/drm/drm_dp_mst_helper.h
> @@ -253,6 +253,7 @@ struct drm_dp_remote_dpcd_write {
>  	u8 *bytes;
>  };
>  
> +#define DP_REMOTE_I2C_READ_MAX_TRANSACTIONS 4
>  struct drm_dp_remote_i2c_read {
>  	u8 num_transactions;
>  	u8 port_number;
> @@ -262,7 +263,7 @@ struct drm_dp_remote_i2c_read {
>  		u8 *bytes;
>  		u8 no_stop_bit;
>  		u8 i2c_transaction_delay;
> -	} transactions[4];
> +	} transactions[DP_REMOTE_I2C_READ_MAX_TRANSACTIONS];
>  	u8 read_i2c_device_id;
>  	u8 num_bytes_read;
>  };
> -- 
> 2.4.3
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch