Skip to content

Commit bb9e0d4

Browse files
committed
drm/i915: Prevent zero length "index" write
The hardware always writes one or two bytes in the index portion of an indexed transfer. Make sure the message we send as the index doesn't have a zero length. Cc: stable@vger.kernel.org Cc: Daniel Kurtz <djkurtz@chromium.org> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Sean Paul <seanpaul@chromium.org> Fixes: 56f9eac ("drm/i915/intel_i2c: use INDEX cycles for i2c read transactions") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20171123194157.25367-3-ville.syrjala@linux.intel.com Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
1 parent c4deb62 commit bb9e0d4

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/gpu/drm/i915/intel_i2c.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,8 @@ gmbus_is_index_read(struct i2c_msg *msgs, int i, int num)
439439
{
440440
return (i + 1 < num &&
441441
msgs[i].addr == msgs[i + 1].addr &&
442-
!(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 &&
442+
!(msgs[i].flags & I2C_M_RD) &&
443+
(msgs[i].len == 1 || msgs[i].len == 2) &&
443444
(msgs[i + 1].flags & I2C_M_RD));
444445
}
445446

0 commit comments

Comments
 (0)