Commit 3b5af317 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab

media: cec: silence shift wrapping warning in __cec_s_log_addrs()

The log_addrs->log_addr_type[i] value is a u8 which is controlled by
the user and comes from the ioctl.  If it's over 31 then that results in
undefined behavior (shift wrapping) and that leads to a Smatch static
checker warning.  We already cap the value later so we can silence the
warning just by re-ordering the existing checks.

I think the UBSan checker will also catch this bug at runtime and
generate a warning.  But otherwise the bug is harmless.

Fixes: 9881fe0c ("[media] cec: add HDMI CEC framework (adapter)")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 62eedb35
...@@ -1734,6 +1734,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap, ...@@ -1734,6 +1734,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
unsigned j; unsigned j;
log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID; log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
dprintk(1, "unknown logical address type\n");
return -EINVAL;
}
if (type_mask & (1 << log_addrs->log_addr_type[i])) { if (type_mask & (1 << log_addrs->log_addr_type[i])) {
dprintk(1, "duplicate logical address type\n"); dprintk(1, "duplicate logical address type\n");
return -EINVAL; return -EINVAL;
...@@ -1754,10 +1758,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap, ...@@ -1754,10 +1758,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
dprintk(1, "invalid primary device type\n"); dprintk(1, "invalid primary device type\n");
return -EINVAL; return -EINVAL;
} }
if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
dprintk(1, "unknown logical address type\n");
return -EINVAL;
}
for (j = 0; j < feature_sz; j++) { for (j = 0; j < feature_sz; j++) {
if ((features[j] & 0x80) == 0) { if ((features[j] & 0x80) == 0) {
if (op_is_dev_features) if (op_is_dev_features)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment