drm/i915: Prevent zero length "index" write
authorVille Syrjälä <ville.syrjala@linux.intel.com>
Thu, 23 Nov 2017 19:41:57 +0000 (21:41 +0200)
committerVille Syrjälä <ville.syrjala@linux.intel.com>
Fri, 24 Nov 2017 14:41:30 +0000 (16:41 +0200)
The hardware always writes one or two bytes in the index portion of
an indexed transfer. Make sure the message we send as the index
doesn't have a zero length.

Cc: stable@vger.kernel.org
Cc: Daniel Kurtz <djkurtz@chromium.org>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Sean Paul <seanpaul@chromium.org>
Fixes: 56f9eac05489 ("drm/i915/intel_i2c: use INDEX cycles for i2c read transactions")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20171123194157.25367-3-ville.syrjala@linux.intel.com
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
drivers/gpu/drm/i915/intel_i2c.c

index 8affd47b98b814cfdcedbb511ebe47d5d90c9fbe..49fdf09f9919c8f29d85f83ee0f3f731796f7713 100644 (file)
@@ -439,7 +439,8 @@ gmbus_is_index_read(struct i2c_msg *msgs, int i, int num)
 {
        return (i + 1 < num &&
                msgs[i].addr == msgs[i + 1].addr &&
-               !(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 &&
+               !(msgs[i].flags & I2C_M_RD) &&
+               (msgs[i].len == 1 || msgs[i].len == 2) &&
                (msgs[i + 1].flags & I2C_M_RD));
 }