Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

[media] cec: an inner loop clobbered the outer loop variable

An inner for-loop reused the outer loop variable. This was
only noticeable with CEC adapters supporting more than one
logical address.

Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

authored by

Hans Verkuil and committed by
Mauro Carvalho Chehab
a161bef0 3145c754

+5 -4
+5 -4
drivers/media/cec/cec-adap.c
··· 1416 1416 const u8 feature_sz = ARRAY_SIZE(log_addrs->features[0]); 1417 1417 u8 *features = log_addrs->features[i]; 1418 1418 bool op_is_dev_features = false; 1419 + unsigned j; 1419 1420 1420 1421 log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID; 1421 1422 if (type_mask & (1 << log_addrs->log_addr_type[i])) { ··· 1443 1442 dprintk(1, "unknown logical address type\n"); 1444 1443 return -EINVAL; 1445 1444 } 1446 - for (i = 0; i < feature_sz; i++) { 1447 - if ((features[i] & 0x80) == 0) { 1445 + for (j = 0; j < feature_sz; j++) { 1446 + if ((features[j] & 0x80) == 0) { 1448 1447 if (op_is_dev_features) 1449 1448 break; 1450 1449 op_is_dev_features = true; 1451 1450 } 1452 1451 } 1453 - if (!op_is_dev_features || i == feature_sz) { 1452 + if (!op_is_dev_features || j == feature_sz) { 1454 1453 dprintk(1, "malformed features\n"); 1455 1454 return -EINVAL; 1456 1455 } 1457 1456 /* Zero unused part of the feature array */ 1458 - memset(features + i + 1, 0, feature_sz - i - 1); 1457 + memset(features + j + 1, 0, feature_sz - j - 1); 1459 1458 } 1460 1459 1461 1460 if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {