Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: cec: silence shift wrapping warning in __cec_s_log_addrs()

The log_addrs->log_addr_type[i] value is a u8 which is controlled by
the user and comes from the ioctl. If it's over 31 then that results in
undefined behavior (shift wrapping) and that leads to a Smatch static
checker warning. We already cap the value later so we can silence the
warning just by re-ordering the existing checks.

I think the UBSan checker will also catch this bug at runtime and
generate a warning. But otherwise the bug is harmless.

Fixes: 9881fe0ca187 ("[media] cec: add HDMI CEC framework (adapter)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

authored by

Dan Carpenter and committed by
Mauro Carvalho Chehab
3b5af317 62eedb35

+4 -4
+4 -4
drivers/media/cec/core/cec-adap.c
··· 1734 1734 unsigned j; 1735 1735 1736 1736 log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID; 1737 + if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) { 1738 + dprintk(1, "unknown logical address type\n"); 1739 + return -EINVAL; 1740 + } 1737 1741 if (type_mask & (1 << log_addrs->log_addr_type[i])) { 1738 1742 dprintk(1, "duplicate logical address type\n"); 1739 1743 return -EINVAL; ··· 1756 1752 } 1757 1753 if (log_addrs->primary_device_type[i] == 2) { 1758 1754 dprintk(1, "invalid primary device type\n"); 1759 - return -EINVAL; 1760 - } 1761 - if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) { 1762 - dprintk(1, "unknown logical address type\n"); 1763 1755 return -EINVAL; 1764 1756 } 1765 1757 for (j = 0; j < feature_sz; j++) {