Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7ae2a888 authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] cec: sanitize msg.flags 



The CEC_MSG_FL_REPLY_TO_FOLLOWERS message flag only makes sense for transmitted
messages where you want to wait for the reply.

Clear the flag in all other cases.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 0dbacebe

drivers/media/cec/cec-adap.c

+4 −0
Original line number Diff line number Diff line
@@ -595,6 +595,10 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, 
		/* Make sure the timeout isn't 0. */

		msg->timeout = 1000;

	}

	if (msg->timeout)

		msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;

	else

		msg->flags = 0;



	/* Sanity checks */

	if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {

drivers/media/cec/cec-api.c

+1 −1
Original line number Diff line number Diff line
@@ -197,7 +197,6 @@ static long cec_transmit(struct cec_adapter *adap, struct cec_fh *fh, 
	    (msg.len == 1 || msg.msg[1] != CEC_MSG_CDC_MESSAGE))

		return -EINVAL;



	msg.flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;

	mutex_lock(&adap->lock);

	if (!adap->is_configured)

		err = -ENONET;
@@ -282,6 +281,7 @@ static long cec_receive(struct cec_adapter *adap, struct cec_fh *fh, 
	err = cec_receive_msg(fh, &msg, block);

	if (err)

		return err;

	msg.flags = 0;

	if (copy_to_user(parg, &msg, sizeof(msg)))

		return -EFAULT;

	return 0;