From: Hans Verkuil <hansverk@xxxxxxxxx>
Some devices (Windows Intel driver!) send a Vendor InfoFrame that
uses a payload length of 0x1b instead of the length of 5 or 6
that the unpack code expects. The InfoFrame is padded with 0 by
the source.
The current code thinks anything other than 5 or 6 is an error,
but larger values are allowed by the specification. So support
that here as well.
Signed-off-by: Hans Verkuil <hansverk@xxxxxxxxx>
---
drivers/video/hdmi.c | 3 +--
include/linux/hdmi.h | 1 +
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c
index 1cf907ecded4..61f803f75a47 100644
--- a/drivers/video/hdmi.c
+++ b/drivers/video/hdmi.c
@@ -1164,8 +1164,7 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame,
struct hdmi_vendor_infoframe *hvf = &frame->hdmi;
if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR ||
- ptr[1] != 1 ||
- (ptr[2] != 5 && ptr[2] != 6))
+ ptr[1] != 1 || ptr[2] < 5 || ptr[2] > HDMI_VENDOR_INFOFRAME_SIZE)
return -EINVAL;
length = ptr[2];
diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h
index d271ff23984f..14d3531a0eda 100644
--- a/include/linux/hdmi.h
+++ b/include/linux/hdmi.h
@@ -40,6 +40,7 @@ enum hdmi_infoframe_type {
#define HDMI_AVI_INFOFRAME_SIZE 13
#define HDMI_SPD_INFOFRAME_SIZE 25
#define HDMI_AUDIO_INFOFRAME_SIZE 10
+#define HDMI_VENDOR_INFOFRAME_SIZE 31
#define HDMI_INFOFRAME_SIZE(type) \
(HDMI_INFOFRAME_HEADER_SIZE + HDMI_ ## type ## _INFOFRAME_SIZE)
--
2.14.1
