Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3074fe4a authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] cec: filter invalid messages 



As per the CEC specification:

- CEC messages with a too-small payload should be ignored.
- Broadcast messages that are only allowed as directed messages
  should be ignored.
- Directed messages that are only allowed as broadcast messages
  should be ignored.

Implement this in the core CEC framework.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent adc0c622

drivers/staging/media/cec/cec-adap.c

+155 −2
Original line number Diff line number Diff line
@@ -762,14 +762,105 @@ EXPORT_SYMBOL_GPL(cec_transmit_msg); 
static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,

			      bool is_reply);



#define DIRECTED	0x80

#define BCAST1_4	0x40

#define BCAST2_0	0x20	/* broadcast only allowed for >= 2.0 */

#define BCAST		(BCAST1_4 | BCAST2_0)

#define BOTH		(BCAST | DIRECTED)



/*

 * Specify minimum length and whether the message is directed, broadcast

 * or both. Messages that do not match the criteria are ignored as per

 * the CEC specification.

 */

static const u8 cec_msg_size[256] = {

	[CEC_MSG_ACTIVE_SOURCE] = 4 | BCAST,

	[CEC_MSG_IMAGE_VIEW_ON] = 2 | DIRECTED,

	[CEC_MSG_TEXT_VIEW_ON] = 2 | DIRECTED,

	[CEC_MSG_INACTIVE_SOURCE] = 4 | DIRECTED,

	[CEC_MSG_REQUEST_ACTIVE_SOURCE] = 2 | BCAST,

	[CEC_MSG_ROUTING_CHANGE] = 6 | BCAST,

	[CEC_MSG_ROUTING_INFORMATION] = 4 | BCAST,

	[CEC_MSG_SET_STREAM_PATH] = 4 | BCAST,

	[CEC_MSG_STANDBY] = 2 | BOTH,

	[CEC_MSG_RECORD_OFF] = 2 | DIRECTED,

	[CEC_MSG_RECORD_ON] = 3 | DIRECTED,

	[CEC_MSG_RECORD_STATUS] = 3 | DIRECTED,

	[CEC_MSG_RECORD_TV_SCREEN] = 2 | DIRECTED,

	[CEC_MSG_CLEAR_ANALOGUE_TIMER] = 13 | DIRECTED,

	[CEC_MSG_CLEAR_DIGITAL_TIMER] = 16 | DIRECTED,

	[CEC_MSG_CLEAR_EXT_TIMER] = 13 | DIRECTED,

	[CEC_MSG_SET_ANALOGUE_TIMER] = 13 | DIRECTED,

	[CEC_MSG_SET_DIGITAL_TIMER] = 16 | DIRECTED,

	[CEC_MSG_SET_EXT_TIMER] = 13 | DIRECTED,

	[CEC_MSG_SET_TIMER_PROGRAM_TITLE] = 2 | DIRECTED,

	[CEC_MSG_TIMER_CLEARED_STATUS] = 3 | DIRECTED,

	[CEC_MSG_TIMER_STATUS] = 3 | DIRECTED,

	[CEC_MSG_CEC_VERSION] = 3 | DIRECTED,

	[CEC_MSG_GET_CEC_VERSION] = 2 | DIRECTED,

	[CEC_MSG_GIVE_PHYSICAL_ADDR] = 2 | DIRECTED,

	[CEC_MSG_GET_MENU_LANGUAGE] = 2 | DIRECTED,

	[CEC_MSG_REPORT_PHYSICAL_ADDR] = 5 | BCAST,

	[CEC_MSG_SET_MENU_LANGUAGE] = 5 | BCAST,

	[CEC_MSG_REPORT_FEATURES] = 6 | BCAST,

	[CEC_MSG_GIVE_FEATURES] = 2 | DIRECTED,

	[CEC_MSG_DECK_CONTROL] = 3 | DIRECTED,

	[CEC_MSG_DECK_STATUS] = 3 | DIRECTED,

	[CEC_MSG_GIVE_DECK_STATUS] = 3 | DIRECTED,

	[CEC_MSG_PLAY] = 3 | DIRECTED,

	[CEC_MSG_GIVE_TUNER_DEVICE_STATUS] = 3 | DIRECTED,

	[CEC_MSG_SELECT_ANALOGUE_SERVICE] = 6 | DIRECTED,

	[CEC_MSG_SELECT_DIGITAL_SERVICE] = 9 | DIRECTED,

	[CEC_MSG_TUNER_DEVICE_STATUS] = 7 | DIRECTED,

	[CEC_MSG_TUNER_STEP_DECREMENT] = 2 | DIRECTED,

	[CEC_MSG_TUNER_STEP_INCREMENT] = 2 | DIRECTED,

	[CEC_MSG_DEVICE_VENDOR_ID] = 5 | BCAST,

	[CEC_MSG_GIVE_DEVICE_VENDOR_ID] = 2 | DIRECTED,

	[CEC_MSG_VENDOR_COMMAND] = 2 | DIRECTED,

	[CEC_MSG_VENDOR_COMMAND_WITH_ID] = 5 | BOTH,

	[CEC_MSG_VENDOR_REMOTE_BUTTON_DOWN] = 2 | BOTH,

	[CEC_MSG_VENDOR_REMOTE_BUTTON_UP] = 2 | BOTH,

	[CEC_MSG_SET_OSD_STRING] = 3 | DIRECTED,

	[CEC_MSG_GIVE_OSD_NAME] = 2 | DIRECTED,

	[CEC_MSG_SET_OSD_NAME] = 2 | DIRECTED,

	[CEC_MSG_MENU_REQUEST] = 3 | DIRECTED,

	[CEC_MSG_MENU_STATUS] = 3 | DIRECTED,

	[CEC_MSG_USER_CONTROL_PRESSED] = 3 | DIRECTED,

	[CEC_MSG_USER_CONTROL_RELEASED] = 2 | DIRECTED,

	[CEC_MSG_GIVE_DEVICE_POWER_STATUS] = 2 | DIRECTED,

	[CEC_MSG_REPORT_POWER_STATUS] = 3 | DIRECTED | BCAST2_0,

	[CEC_MSG_FEATURE_ABORT] = 4 | DIRECTED,

	[CEC_MSG_ABORT] = 2 | DIRECTED,

	[CEC_MSG_GIVE_AUDIO_STATUS] = 2 | DIRECTED,

	[CEC_MSG_GIVE_SYSTEM_AUDIO_MODE_STATUS] = 2 | DIRECTED,

	[CEC_MSG_REPORT_AUDIO_STATUS] = 3 | DIRECTED,

	[CEC_MSG_REPORT_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,

	[CEC_MSG_REQUEST_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,

	[CEC_MSG_SET_SYSTEM_AUDIO_MODE] = 3 | BOTH,

	[CEC_MSG_SYSTEM_AUDIO_MODE_REQUEST] = 2 | DIRECTED,

	[CEC_MSG_SYSTEM_AUDIO_MODE_STATUS] = 3 | DIRECTED,

	[CEC_MSG_SET_AUDIO_RATE] = 3 | DIRECTED,

	[CEC_MSG_INITIATE_ARC] = 2 | DIRECTED,

	[CEC_MSG_REPORT_ARC_INITIATED] = 2 | DIRECTED,

	[CEC_MSG_REPORT_ARC_TERMINATED] = 2 | DIRECTED,

	[CEC_MSG_REQUEST_ARC_INITIATION] = 2 | DIRECTED,

	[CEC_MSG_REQUEST_ARC_TERMINATION] = 2 | DIRECTED,

	[CEC_MSG_TERMINATE_ARC] = 2 | DIRECTED,

	[CEC_MSG_REQUEST_CURRENT_LATENCY] = 4 | BCAST,

	[CEC_MSG_REPORT_CURRENT_LATENCY] = 7 | BCAST,

	[CEC_MSG_CDC_MESSAGE] = 2 | BCAST,

};



/* Called by the CEC adapter if a message is received */

void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)

{

	struct cec_data *data;

	u8 msg_init = cec_msg_initiator(msg);

	u8 msg_dest = cec_msg_destination(msg);

	u8 cmd = msg->msg[1];

	bool is_reply = false;

	bool valid_la = true;

	u8 min_len = 0;



	if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))

		return;
@@ -789,9 +880,71 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg) 
	if (!cec_msg_is_broadcast(msg))

		valid_la = cec_has_log_addr(adap, msg_dest);



	/*

	 * Check if the length is not too short or if the message is a

	 * broadcast message where a directed message was expected or

	 * vice versa. If so, then the message has to be ignored (according

	 * to section CEC 7.3 and CEC 12.2).

	 */

	if (valid_la && msg->len > 1 && cec_msg_size[cmd]) {

		u8 dir_fl = cec_msg_size[cmd] & BOTH;



		min_len = cec_msg_size[cmd] & 0x1f;

		if (msg->len < min_len)

			valid_la = false;

		else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))

			valid_la = false;

		else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4))

			valid_la = false;

		else if (cec_msg_is_broadcast(msg) &&

			 adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 &&

			 !(dir_fl & BCAST2_0))

			valid_la = false;

	}

	if (valid_la && min_len) {

		/* These messages have special length requirements */

		switch (cmd) {

		case CEC_MSG_TIMER_STATUS:

			if (msg->msg[2] & 0x10) {

				switch (msg->msg[2] & 0xf) {

				case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:

				case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:

					if (msg->len < 5)

						valid_la = false;

					break;

				}

			} else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {

				if (msg->len < 5)

					valid_la = false;

			}

			break;

		case CEC_MSG_RECORD_ON:

			switch (msg->msg[2]) {

			case CEC_OP_RECORD_SRC_OWN:

				break;

			case CEC_OP_RECORD_SRC_DIGITAL:

				if (msg->len < 10)

					valid_la = false;

				break;

			case CEC_OP_RECORD_SRC_ANALOG:

				if (msg->len < 7)

					valid_la = false;

				break;

			case CEC_OP_RECORD_SRC_EXT_PLUG:

				if (msg->len < 4)

					valid_la = false;

				break;

			case CEC_OP_RECORD_SRC_EXT_PHYS_ADDR:

				if (msg->len < 5)

					valid_la = false;

				break;

			}

			break;

		}

	}



	/* It's a valid message and not a poll or CDC message */

	if (valid_la && msg->len > 1 && msg->msg[1] != CEC_MSG_CDC_MESSAGE) {

		u8 cmd = msg->msg[1];

	if (valid_la && msg->len > 1 && cmd != CEC_MSG_CDC_MESSAGE) {

		bool abort = cmd == CEC_MSG_FEATURE_ABORT;



		/* The aborted command is in msg[2] */