Received: by 10.223.185.116 with SMTP id b49csp6377214wrg; Wed, 28 Feb 2018 08:24:59 -0800 (PST) X-Google-Smtp-Source: AH8x227g5B0a8QsM4B/V27l0Fz77phC8GwPBMDKcX4GsKqeMy9shxF4RZZlaE+GtNvm6h/crdC2+ X-Received: by 2002:a17:902:27:: with SMTP id 36-v6mr18544421pla.128.1519835099259; Wed, 28 Feb 2018 08:24:59 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519835099; cv=none; d=google.com; s=arc-20160816; b=PnC7mw1xURrzRrDMORS0rOsTGV6RqltPVbMj9r0WydExgBX2UpkldeM8Bgn4a+uUBz bl69gmquMY1zlM/DQHIjrivte2aw33dfsQwS0zOzzb5p3+Rf87Q883XwI/ZATXvQpf1S YJcgMpZXoZOoSRXmIW5GU3shBVVW+U0nM7rCvTah0GGsykcztvlEu6frlGczYmZaVdI5 p7GZyG/ABTSHEoVk9LgXzMVpD6pL/xsSAFxoU5L0XGDo7WKMkugGtccK4ZVJ2TprW5fr Z20HSbmI0w8vqw5g6JQc4LsE/GaIuSqo6/yl09kF1/W5zvDR8BUnoGoFlfP+SDPpW2h8 IM3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=MAi84YeOo6JMZwJKilOQ23xZu0J9R7FNuIygZ5j6is0=; b=DwveU5y8K5Wduy90a3yEvLiQzBg6IxCCDKpaxDWz3UYxMzdDx6qctcdzFcV9T/VpE5 CA4/vVvyq5GC6HH9yYra0reu/2M2F05l0sbYnCNgJ5w8USr3JvoT9XcNON2YE/EA4uZf qGNywafxT0fLGxL9g2A3dGNJ1BJLD734cXktJBubqugbaP2BPBxHy3rGWpIB1jvXksow ySKLmX+RU7UacaYuVohzHX2ZrJKV2ThLG2ev+BhT3mCtfcZRGkXwwktcP5GIORpx+Ypo hDEJQ8ryv54qodsWaqQvz40edD8Mzq8hFegdpps5bzRiO8k4gvMZJdGxJKYRIsRRneFJ wncQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u132si1189238pgc.802.2018.02.28.08.24.44; Wed, 28 Feb 2018 08:24:59 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932876AbeB1QUn (ORCPT + 99 others); Wed, 28 Feb 2018 11:20:43 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35375 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935188AbeB1QUk (ORCPT ); Wed, 28 Feb 2018 11:20:40 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Yv-0006Xe-A2; Wed, 28 Feb 2018 15:22:33 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yd-0008Nb-E3; Wed, 28 Feb 2018 15:22:15 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Chris Wilson" , "Daniel Vetter" , "Daniel Kurtz" , "Sean Paul" , "=?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?=" , "Joonas Lahtinen" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 019/254] drm/i915: Prevent zero length "index" write In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Ville Syrjälä commit 56350fb8978bbf4aafe08f21234e161dd128b417 upstream. The hardware always writes one or two bytes in the index portion of an indexed transfer. Make sure the message we send as the index doesn't have a zero length. Cc: Daniel Kurtz Cc: Chris Wilson Cc: Daniel Vetter Cc: Sean Paul Fixes: 56f9eac05489 ("drm/i915/intel_i2c: use INDEX cycles for i2c read transactions") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20171123194157.25367-3-ville.syrjala@linux.intel.com Reviewed-by: Chris Wilson (cherry picked from commit bb9e0d4bca50f429152e74a459160b41f3d60fb2) Signed-off-by: Joonas Lahtinen Signed-off-by: Ben Hutchings --- drivers/gpu/drm/i915/intel_i2c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/i915/intel_i2c.c +++ b/drivers/gpu/drm/i915/intel_i2c.c @@ -449,7 +449,8 @@ gmbus_is_index_read(struct i2c_msg *msgs { return (i + 1 < num && msgs[i].addr == msgs[i + 1].addr && - !(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 && + !(msgs[i].flags & I2C_M_RD) && + (msgs[i].len == 1 || msgs[i].len == 2) && (msgs[i + 1].flags & I2C_M_RD)); }