blob: b256922d0e8385ba6ea623ce69a5150f77240c5d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
From d9275251d3eb9cbc978263f54b736d66a958ed46 Mon Sep 17 00:00:00 2001
From: Shirish S <shirish.s@amd.com>
Date: Tue, 13 Mar 2018 11:55:11 +0530
Subject: [PATCH 3772/4131] drm/amd/display: Check msg->size before starting
aux transfer
This patch adds an essential check related to the size of the
payload to be transferred via aux channel.
Without this check dal_ddc_service_read_dpcd_data() is fed with
inappropriate payload size leading to deadlocks.
Signed-off-by: Shirish S <shirish.s@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index c612329..b88b0e4 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -84,6 +84,9 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
enum ddc_result res;
ssize_t read_bytes;
+ if (WARN_ON(msg->size > 16))
+ return -E2BIG;
+
switch (msg->request & ~DP_AUX_I2C_MOT) {
case DP_AUX_NATIVE_READ:
read_bytes = dal_ddc_service_read_dpcd_data(
--
2.7.4
|
