drm/amd/display: Check msg->size before starting aux transfer
authorShirish S <shirish.s@amd.com>
Tue, 13 Mar 2018 06:25:11 +0000 (11:55 +0530)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 14 Mar 2018 21:01:15 +0000 (16:01 -0500)
This patch adds an essential check related to the size of the
payload to be transferred via aux channel.

Without this check dal_ddc_service_read_dpcd_data() is fed with
inappropriate payload size leading to deadlocks.

Signed-off-by: Shirish S <shirish.s@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c

index 39cfe0fbf1b97c555b9e69a5719d64912412a665..8291d74f26bcfd8934f424232297b7b60822268d 100644 (file)
@@ -85,6 +85,9 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
        enum ddc_result res;
        ssize_t read_bytes;
 
+       if (WARN_ON(msg->size > 16))
+               return -E2BIG;
+
        switch (msg->request & ~DP_AUX_I2C_MOT) {
        case DP_AUX_NATIVE_READ:
                read_bytes = dal_ddc_service_read_dpcd_data(