[media] cec: sanitize msg.flags

The CEC_MSG_FL_REPLY_TO_FOLLOWERS message flag only makes sense for transmitted
messages where you want to wait for the reply.

Clear the flag in all other cases.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 054cd06e2247962b6bb2778d8900738b2127464c..bcd19d41c1663f5886bd2307f4fd4d7007f291f9 100644 (file)
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -595,6 +595,10 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
                /* Make sure the timeout isn't 0. */
                msg->timeout = 1000;
        }
+       if (msg->timeout)
+               msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
+       else
+               msg->flags = 0;
 
        /* Sanity checks */
        if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {

diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index d4bc4ee2c6e556a427428a5d70c9c3a758462ac2..597fbb62d82927bd7b489b34cad8f5d1a778d154 100644 (file)
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c
@@ -197,7 +197,6 @@ static long cec_transmit(struct cec_adapter *adap, struct cec_fh *fh,
            (msg.len == 1 || msg.msg[1] != CEC_MSG_CDC_MESSAGE))
                return -EINVAL;
 
-       msg.flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
        mutex_lock(&adap->lock);
        if (!adap->is_configured)
                err = -ENONET;
@@ -282,6 +281,7 @@ static long cec_receive(struct cec_adapter *adap, struct cec_fh *fh,
        err = cec_receive_msg(fh, &msg, block);
        if (err)
                return err;
+       msg.flags = 0;
        if (copy_to_user(parg, &msg, sizeof(msg)))
                return -EFAULT;
        return 0;