From patchwork Tue Dec 12 00:55:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Doug Anderson X-Patchwork-Id: 177000 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp7434779vqy; Mon, 11 Dec 2023 16:56:13 -0800 (PST) X-Google-Smtp-Source: AGHT+IEnaiv+t+QAlb7CcRohWo7wzqCPV3ov0EZshZya4t9koSPOmcmswcRMQ4GUkhQB5/Yf5K3P X-Received: by 2002:a05:6808:1a1c:b0:3ae:144f:f99b with SMTP id bk28-20020a0568081a1c00b003ae144ff99bmr6028003oib.4.1702342573655; Mon, 11 Dec 2023 16:56:13 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702342573; cv=none; d=google.com; s=arc-20160816; b=LamqChDerq3AJgnl7rJEI7SrQ3NUrtlEPxgox8JHO9kAGery34nA/NG9PmPyFakhxJ Huf0cx+dHskRxiQVaiceAGoxbH2hpeqwVZQovK8q7g7QYDR/sDv2SWi/0h4A5G5Q3Go4 U3Vpho3oSvpiJ42EDHLlXIaAD/c0N/ghG1QS022N2NCHebrfaBtI6i0DZEFT5cu6Hyi4 7VxzBNaKW8BoL4ISfFn3eipr3qQ+dxSd/bqp3YnZ7UvXvNebR51Ka0CavOondnAkzVZ6 v11UBROAo2XE+goRBZd2UJ6MjXeo6VQRfmdV79aS0m8cxQMRJ1wQ0RJ0VZpAj7JPbrfK 9pGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=AS84DpIlnHadbg548UoBHWDlxNfb0zaNqIcRTC+jUtI=; fh=T1KrKhWWyE62TtphBCaXzFyyJbcFwutnKT6UL/OOXx0=; b=A2OljhvhHMIilZl7RxS+Gwk8wq/w6Cor2iQgLDrkZSqCZmEdwSdIWft7xwev9i7BkV n6uOfXZvm6AjYFj8/Q4Qn6dxlfQ9L3ddz9Acb7NyAkMXt5koR0o1FuJxdU1K8GSZA8tn H2DEENWElMRgpwvQjXaO8+GhKDnn+MUePn8vYN6TzwkPA97aetqNBtWXjQgwtXNJENYQ xpzYUWFR+E2ECjE7mGmwAdmDusSRgpjgSUHVcMRQjLjPTi/WaYb9/8mBXE+bK9k/Oju/ 5QY7uWCrIm/EkXvaWxGl/x2az3lIZ0q7SfUwIWbvie/ogLxTHtlgvLt2XYDvC9LZNKsT AK9g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=YlSdnOyX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from fry.vger.email (fry.vger.email. [2620:137:e000::3:8]) by mx.google.com with ESMTPS id j7-20020a654287000000b00578d3f8d4d4si6834753pgp.448.2023.12.11.16.56.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 Dec 2023 16:56:13 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) client-ip=2620:137:e000::3:8; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=YlSdnOyX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by fry.vger.email (Postfix) with ESMTP id 197FC8077846; Mon, 11 Dec 2023 16:56:10 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at fry.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345595AbjLLA4B (ORCPT + 99 others); Mon, 11 Dec 2023 19:56:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54102 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345586AbjLLA4A (ORCPT ); Mon, 11 Dec 2023 19:56:00 -0500 Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com [IPv6:2607:f8b0:4864:20::433]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4BA0EA6 for ; Mon, 11 Dec 2023 16:56:04 -0800 (PST) Received: by mail-pf1-x433.google.com with SMTP id d2e1a72fcca58-6d089e8b1b2so1013686b3a.3 for ; Mon, 11 Dec 2023 16:56:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1702342564; x=1702947364; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=AS84DpIlnHadbg548UoBHWDlxNfb0zaNqIcRTC+jUtI=; b=YlSdnOyXMByLaQfNmdthP4sQNIx0oUxERCQngpCzx5282Q831WiOtJmQ0Tr4C5SW4w zRKv57i6UUBpWW/PpeZUuD80IbC+LQaxc/cMkJ0f5NQtLyMvejDtH1dmIlrOo9Lk+a8y aV0ymxy0PYGce8pBu0OvaXrTlJF8ilOZNxsMI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702342564; x=1702947364; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=AS84DpIlnHadbg548UoBHWDlxNfb0zaNqIcRTC+jUtI=; b=beTuSs9MkEdM5Iccf7cRdXzFMGd+Q/MlifgsjtKtzBqeqlIdqxExj4k24giAyFDWCH xmYq8045xigNH/pz7HE9WBBctQEhEkadYk/qeWmqOzyQ0L8d0yfLm95t168Uk89beZLt JItaQWVPnhqhY01m6JNfXcxTyAlgZL0Q/dM39VFH8c4PkJzrRli/Tq+X9YlUIHx4DqvK 9fpOlnB9TeKs/nZY+OaMSXHWWhfKmAmWRjT2SX5HeD8rqbP64YaoZY9PQydhpvHV/PSA mIqZV7HdbfIcKjl+qYWv3ZF78n3vbFlFFj7iJEUvToUOQrnXCnloIWqPmB3g5mIBCKV3 yRaA== X-Gm-Message-State: AOJu0YxkkkUkBAJWWxvbt9GdqkJdwFhsY4io7lRBClhE+TTiAERzGRG5 zF+yd+0fWgU1VZAO3ZqEtawK/A== X-Received: by 2002:a05:6a21:99a4:b0:18c:18d3:c8fd with SMTP id ve36-20020a056a2199a400b0018c18d3c8fdmr3061776pzb.14.1702342563762; Mon, 11 Dec 2023 16:56:03 -0800 (PST) Received: from tictac2.mtv.corp.google.com ([2620:15c:9d:2:5c08:e1ed:d922:d30c]) by smtp.gmail.com with ESMTPSA id k10-20020a170902694a00b001cc311ef152sm7251271plt.286.2023.12.11.16.56.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 Dec 2023 16:56:03 -0800 (PST) From: Douglas Anderson To: dri-devel@lists.freedesktop.org Cc: Douglas Anderson , Andrzej Hajda , Daniel Vetter , David Airlie , Jernej Skrabec , Jonas Karlman , Laurent Pinchart , Maarten Lankhorst , Maxime Ripard , Neil Armstrong , Philip Chen , Robert Foss , Sam Ravnborg , Stephen Boyd , Thomas Zimmermann , linux-kernel@vger.kernel.org Subject: [PATCH 1/2] drm/bridge: parade-ps8640: Never increase the length when reading from AUX Date: Mon, 11 Dec 2023 16:55:26 -0800 Message-ID: <20231211165526.1.I9d1afcaad76a3e2c0ca046dc4adbc2b632c22eda@changeid> X-Mailer: git-send-email 2.43.0.472.g3155946c3a-goog MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Mon, 11 Dec 2023 16:56:10 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785035566669649462 X-GMAIL-MSGID: 1785035566669649462 While testing, I happened to notice a random crash that looked like: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: drm_dp_dpcd_probe+0x120/0x120 Analysis of drm_dp_dpcd_probe() shows that we pass in a 1-byte buffer (allocated on the stack) to the aux->transfer() function. Presumably if the aux->transfer() writes more than one byte to this buffer then we're in a bad shape. Dropping into kgdb, I noticed that "aux->transfer" pointed at ps8640_aux_transfer(). Reading through ps8640_aux_transfer(), I can see that there are cases where it could write more bytes to msg->buffer than were specified by msg->size. This could happen if the hardware reported back something bogus to us. Let's fix this so we never increase the length. NOTE: I have no actual way to reproduce this issue but it seems likely this is what was happening in the crash I looked at. Fixes: 13afcdd7277e ("drm/bridge: parade-ps8640: Add support for AUX channel") Signed-off-by: Douglas Anderson --- drivers/gpu/drm/bridge/parade-ps8640.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c index 8161b1a1a4b1..fb2ec4264549 100644 --- a/drivers/gpu/drm/bridge/parade-ps8640.c +++ b/drivers/gpu/drm/bridge/parade-ps8640.c @@ -302,7 +302,7 @@ static ssize_t ps8640_aux_transfer_msg(struct drm_dp_aux *aux, fallthrough; case SWAUX_STATUS_ACKM: - len = data & SWAUX_M_MASK; + len = min(len, (unsigned int)(data & SWAUX_M_MASK)); break; case SWAUX_STATUS_DEFER: case SWAUX_STATUS_I2C_DEFER: @@ -310,7 +310,7 @@ static ssize_t ps8640_aux_transfer_msg(struct drm_dp_aux *aux, msg->reply |= DP_AUX_NATIVE_REPLY_DEFER; else msg->reply |= DP_AUX_I2C_REPLY_DEFER; - len = data & SWAUX_M_MASK; + len = min(len, (unsigned int)(data & SWAUX_M_MASK)); break; case SWAUX_STATUS_INVALID: return -EOPNOTSUPP; From patchwork Tue Dec 12 00:55:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Doug Anderson X-Patchwork-Id: 177001 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp7435073vqy; Mon, 11 Dec 2023 16:57:14 -0800 (PST) X-Google-Smtp-Source: AGHT+IHa/J2+8W4oDirm/VAAzEK1J+RqrUrLfey4PGBzuF5lCTev5AABoTr8yN+QoMcfvU0/KLpQ X-Received: by 2002:a05:6a20:1303:b0:18d:c72:63b3 with SMTP id g3-20020a056a20130300b0018d0c7263b3mr5659240pzh.16.1702342634404; Mon, 11 Dec 2023 16:57:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702342634; cv=none; d=google.com; s=arc-20160816; b=KnvCbIKzUdfr5WXSlv8jN7AFnILLE6+fc81VIfoRCrQjc/2Mez9sXYHS4ylrNhWssF ag9Tb5EMEdYtQmOHcLwYdZHihS+u0kysRW5KQkR+c2/ONGMJNz7Gb7tYcG2F0dKl/V6E kd3eFdl7uLewIKmb0qTCCQVWIiqURLxL6eDPhXf6ygru4g00kviEkU80w+UNUDFXcS1J qxtklxzWLyildCk4185Axf+180q47lBJC0Zlw5BwH6Vz0Rv0+5Y4S8WypwLrQ9+hjMyn 4HI6kdf3PIvosa1QsB/AwSB+3/Cyxyagz6QQCxuRdY/hy4dKlzkNC5GNpV69b88dEZea Q3Ag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=VII/LMlRWrPvYBfcRDAQD7A22/Kx5Gqvp4PO6BWVrDg=; fh=tywlyjLe7/FLa1qnZc/+BjGpyWPBT20tp8e+wkGawog=; b=wF/MgsFqq/LTb70sskaVw4H3OCyZDuE3v1qFf7PkUqxcUQfAYqD5QBuJ3lDX4NWjbh 4M2QFcnPAkThwiNtIkrDDJ8p1eiOjTR0AmgtDzQH58H8cEwUE3AjhLsQbHq76F51nWZp Oyc5by5cZJgxfaTZwENyOtzHUydQATG9+Jm8kaeY05FiXbaLGa3pzpeaDs/epbxIVQTS FqHMePOdyVJWVMeONybx1rQFQ2hM+RvPTzw8D7Rd9wkklnmDTdhQaf+gFALcA7vKQMRC EfsNrbiT9zKSoMFvwWvI3izuG+DxX2cf0fYELJrDMnwNwNMkwjz4jEvI+Z1zJOpVFnIV /yXQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=eTGscO3F; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id o8-20020a17090ac70800b0028ab0c61b77si804078pjt.112.2023.12.11.16.57.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 Dec 2023 16:57:14 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=eTGscO3F; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id A201580781FE; Mon, 11 Dec 2023 16:56:15 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345611AbjLLA4D (ORCPT + 99 others); Mon, 11 Dec 2023 19:56:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345477AbjLLA4A (ORCPT ); Mon, 11 Dec 2023 19:56:00 -0500 Received: from mail-pl1-x634.google.com (mail-pl1-x634.google.com [IPv6:2607:f8b0:4864:20::634]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 088CAB8 for ; Mon, 11 Dec 2023 16:56:06 -0800 (PST) Received: by mail-pl1-x634.google.com with SMTP id d9443c01a7336-1d0a7b72203so44872835ad.2 for ; Mon, 11 Dec 2023 16:56:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1702342565; x=1702947365; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=VII/LMlRWrPvYBfcRDAQD7A22/Kx5Gqvp4PO6BWVrDg=; b=eTGscO3FKKVYnqTVIFqA//eGs+yIecl/Jy5zV2jnFp9ltxuwSIweG75uky/8NGwMDW 7ir6ZAPnkkwz56fFb6RXuRA7h4h0lvlfhtPeKLRHhJPEsvYE4pM+iLzJtDxPgn8Ei48T G7WzRBbPL8ehFnNGYylvn4jY1W3FO+s7Kao4g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702342565; x=1702947365; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VII/LMlRWrPvYBfcRDAQD7A22/Kx5Gqvp4PO6BWVrDg=; b=akBT6iyBO9PqXgvaAAd6PGbklwiritHQk++yf9l71kAIwgSxeSNGJA/badD/HPcUEx RIBSAkHC+sEU3mrH7mzVxTDsU0F1csPtAQooIWGb4u9HMeEBF0uy/6SRmot/mOu1zWQI iSZIT7BlIoQhn+vr974ZPeh8AOYjX7fE6uJfEwErQuZ3RQgE/zD/x7FzJ070S7pzPbcu 05UGrzYDz5sBJW2331vRgueNtlozvcZW/BB4/5DYt/aKIFR1M9ABUuDUdJHMSTZE/tQQ 9g1Z/o0U5ypD8CtUTJeh3YQJ/N6RK/q2/5YeU4XrovHg842wfW0Hk2gc+X2FFOKgnuk9 3LKg== X-Gm-Message-State: AOJu0Yzm5xO8Q2WMYnqeBsdQScf1NM7Nzk09x9ygqPF1bvGroPdwEtDR sBj08wQW/mMw0LHLtvdUWLt1zA== X-Received: by 2002:a17:903:1206:b0:1d2:f388:6df3 with SMTP id l6-20020a170903120600b001d2f3886df3mr6013703plh.48.1702342565555; Mon, 11 Dec 2023 16:56:05 -0800 (PST) Received: from tictac2.mtv.corp.google.com ([2620:15c:9d:2:5c08:e1ed:d922:d30c]) by smtp.gmail.com with ESMTPSA id k10-20020a170902694a00b001cc311ef152sm7251271plt.286.2023.12.11.16.56.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 Dec 2023 16:56:05 -0800 (PST) From: Douglas Anderson To: dri-devel@lists.freedesktop.org Cc: Douglas Anderson , Andrzej Hajda , Daniel Vetter , David Airlie , Jernej Skrabec , Jonas Karlman , Laurent Pinchart , Maarten Lankhorst , Maxime Ripard , Neil Armstrong , Robert Foss , Sam Ravnborg , Stephen Boyd , Thomas Zimmermann , linux-kernel@vger.kernel.org Subject: [PATCH 2/2] drm/bridge: ti-sn65dsi86: Never increase the length when reading from AUX Date: Mon, 11 Dec 2023 16:55:27 -0800 Message-ID: <20231211165526.2.I7b83c0f31aeedc6b1dc98c7c741d3e1f94f040f8@changeid> X-Mailer: git-send-email 2.43.0.472.g3155946c3a-goog In-Reply-To: <20231211165526.1.I9d1afcaad76a3e2c0ca046dc4adbc2b632c22eda@changeid> References: <20231211165526.1.I9d1afcaad76a3e2c0ca046dc4adbc2b632c22eda@changeid> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Mon, 11 Dec 2023 16:56:15 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785035630191260717 X-GMAIL-MSGID: 1785035630191260717 For aux reads, the value `msg->size` indicates the size of the buffer provided by `msg->buffer`. We should never in any circumstances write more bytes to the buffer since it may overflow the buffer. In the ti-sn65dsi86 driver there is one code path that reads the transfer length from hardware. Even though it's never been seen to be a problem, we should make extra sure that the hardware isn't increasing the length since doing so would cause us to overrun the buffer. Fixes: 982f589bde7a ("drm/bridge: ti-sn65dsi86: Update reply on aux failures") Signed-off-by: Douglas Anderson --- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c index 5b8e1dfc458d..7ff465241267 100644 --- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c +++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c @@ -527,6 +527,7 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, u32 request_val = AUX_CMD_REQ(msg->request); u8 *buf = msg->buffer; unsigned int len = msg->size; + unsigned int short_len; unsigned int val; int ret; u8 addr_len[SN_AUX_LENGTH_REG + 1 - SN_AUX_ADDR_19_16_REG]; @@ -600,7 +601,8 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, } if (val & AUX_IRQ_STATUS_AUX_SHORT) { - ret = regmap_read(pdata->regmap, SN_AUX_LENGTH_REG, &len); + ret = regmap_read(pdata->regmap, SN_AUX_LENGTH_REG, &short_len); + len = min(len, short_len); if (ret) goto exit; } else if (val & AUX_IRQ_STATUS_NAT_I2C_FAIL) {