lkml.org 
[lkml]   [2020]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 110/190] media: cec: silence shift wrapping warning in __cec_s_log_addrs()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 3b5af3171e2d5a73ae6f04965ed653d039904eb6 ]

    The log_addrs->log_addr_type[i] value is a u8 which is controlled by
    the user and comes from the ioctl. If it's over 31 then that results in
    undefined behavior (shift wrapping) and that leads to a Smatch static
    checker warning. We already cap the value later so we can silence the
    warning just by re-ordering the existing checks.

    I think the UBSan checker will also catch this bug at runtime and
    generate a warning. But otherwise the bug is harmless.

    Fixes: 9881fe0ca187 ("[media] cec: add HDMI CEC framework (adapter)")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/cec/cec-adap.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
    index 0d7d687aeea0..061b7824f698 100644
    --- a/drivers/media/cec/cec-adap.c
    +++ b/drivers/media/cec/cec-adap.c
    @@ -1624,6 +1624,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
    unsigned j;

    log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
    + if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
    + dprintk(1, "unknown logical address type\n");
    + return -EINVAL;
    + }
    if (type_mask & (1 << log_addrs->log_addr_type[i])) {
    dprintk(1, "duplicate logical address type\n");
    return -EINVAL;
    @@ -1644,10 +1648,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
    dprintk(1, "invalid primary device type\n");
    return -EINVAL;
    }
    - if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
    - dprintk(1, "unknown logical address type\n");
    - return -EINVAL;
    - }
    for (j = 0; j < feature_sz; j++) {
    if ((features[j] & 0x80) == 0) {
    if (op_is_dev_features)
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-06-19 16:49    [W:4.323 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site