diff options
| author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2022-08-24 10:02:42 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-11-10 20:14:22 +0300 |
| commit | 1609231f86760c1f6a429de7913dd795b9faa08c (patch) | |
| tree | 5e061373b8db60b01d66efb0bc6a2f653dc6ab91 /drivers | |
| parent | c46759e3703b9d0472e34ebf3e8d3fdde207d09c (diff) | |
| download | linux-1609231f86760c1f6a429de7913dd795b9faa08c.tar.xz | |
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
[ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ]
I expect that the hardware will have limited this to 16, but just in
case it hasn't, check for this corner case.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/cec/platform/s5p/s5p_cec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c index 028a09a7531e..102f1af01000 100644 --- a/drivers/media/cec/platform/s5p/s5p_cec.c +++ b/drivers/media/cec/platform/s5p/s5p_cec.c @@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); |