mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-08 17:49:45 +00:00
media: cec: silence shift wrapping warning in __cec_s_log_addrs()
[ Upstream commit3b5af3171e
] The log_addrs->log_addr_type[i] value is a u8 which is controlled by the user and comes from the ioctl. If it's over 31 then that results in undefined behavior (shift wrapping) and that leads to a Smatch static checker warning. We already cap the value later so we can silence the warning just by re-ordering the existing checks. I think the UBSan checker will also catch this bug at runtime and generate a warning. But otherwise the bug is harmless. Fixes:9881fe0ca1
("[media] cec: add HDMI CEC framework (adapter)") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
b0687a01d6
commit
26311fa940
1 changed files with 4 additions and 4 deletions
|
@ -1668,6 +1668,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
|
|||
unsigned j;
|
||||
|
||||
log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
|
||||
if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
|
||||
dprintk(1, "unknown logical address type\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
if (type_mask & (1 << log_addrs->log_addr_type[i])) {
|
||||
dprintk(1, "duplicate logical address type\n");
|
||||
return -EINVAL;
|
||||
|
@ -1688,10 +1692,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
|
|||
dprintk(1, "invalid primary device type\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
|
||||
dprintk(1, "unknown logical address type\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
for (j = 0; j < feature_sz; j++) {
|
||||
if ((features[j] & 0x80) == 0) {
|
||||
if (op_is_dev_features)
|
||||
|
|
Loading…
Reference in a new issue