[Intel-gfx] [PATCH 2/5] drm/dp/mst: Validate REMOTE_I2C_READ harder

[Dhinakaran Pandiyan]

On Fri, 2018-09-28 at 21:04 +0300, Ville Syrjala wrote:
> From: Ville Syrjälä <ville.syrjala at linux.intel.com>
> 
> Make sure i2c msgs we're asked to transfer conform to the
> requirements of REMOTE_I2C_READ. We were only checking that the
> last message is a read, but we must also check that the preceding
> messages are all writes. Also check that the length of each
> message isn't too long.

Right, the syntax for i2c_remote_read allows only 8 bits for length.
Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan at intel.com>


> 
> Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
> ---
>  drivers/gpu/drm/drm_dp_mst_topology.c | 25 ++++++++++++++++++-------
>  1 file changed, 18 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c
> b/drivers/gpu/drm/drm_dp_mst_topology.c
> index 3b400eab18a2..a0652fc166c6 100644
> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> @@ -3239,6 +3239,23 @@ void drm_dp_mst_topology_mgr_destroy(struct
> drm_dp_mst_topology_mgr *mgr)
>  }
>  EXPORT_SYMBOL(drm_dp_mst_topology_mgr_destroy);
>  
> +static bool remote_i2c_read_ok(const struct i2c_msg msgs[], int num)
> +{
> +	int i;
> +
> +	if (num - 1 > DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)
> +		return false;
> +
> +	for (i = 0; i < num - 1; i++) {
> +		if (msgs[i].flags & I2C_M_RD ||
> +		    msgs[i].len > 0xff)
> +			return false;
> +	}
> +
> +	return msgs[num - 1].flags & I2C_M_RD &&
> +		msgs[num - 1].len <= 0xff;
> +}
> +
>  /* I2C device */
>  static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct
> i2c_msg *msgs,
>  			       int num)
> @@ -3248,7 +3265,6 @@ static int drm_dp_mst_i2c_xfer(struct
> i2c_adapter *adapter, struct i2c_msg *msgs
>  	struct drm_dp_mst_branch *mstb;
>  	struct drm_dp_mst_topology_mgr *mgr = port->mgr;
>  	unsigned int i;
> -	bool reading = false;
>  	struct drm_dp_sideband_msg_req_body msg;
>  	struct drm_dp_sideband_msg_tx *txmsg = NULL;
>  	int ret;
> @@ -3257,12 +3273,7 @@ static int drm_dp_mst_i2c_xfer(struct
> i2c_adapter *adapter, struct i2c_msg *msgs
>  	if (!mstb)
>  		return -EREMOTEIO;
>  
> -	/* construct i2c msg */
> -	/* see if last msg is a read */
> -	if (msgs[num - 1].flags & I2C_M_RD)
> -		reading = true;
> -
> -	if (!reading || (num - 1 >
> DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)) {
> +	if (!remote_i2c_read_ok(msgs, num)) {
>  		DRM_DEBUG_KMS("Unsupported I2C transaction for MST
> device\n");
>  		ret = -EIO;
>  		goto out;