From: Sean Young <sean@mess.org>
Date: Mon, 7 Aug 2017 13:21:29 +0000 (-0400)
Subject: media: rc: ensure we do not read out of bounds
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2168b416c8326cc2edff9d986feebc569cf9ec10;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

media: rc: ensure we do not read out of bounds

If rc_validate_filter() is called for CEC or XMP, then we would read
beyond the end of the array.

Suggested-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index f306e67b8b66..7aaf28bcb01e 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -733,7 +733,7 @@ EXPORT_SYMBOL_GPL(rc_keydown_notimeout);
 static int rc_validate_filter(struct rc_dev *dev,
 			      struct rc_scancode_filter *filter)
 {
-	static u32 masks[] = {
+	static const u32 masks[] = {
 		[RC_TYPE_RC5] = 0x1f7f,
 		[RC_TYPE_RC5X_20] = 0x1f7f3f,
 		[RC_TYPE_RC5_SZ] = 0x2fff,
@@ -757,6 +757,9 @@ static int rc_validate_filter(struct rc_dev *dev,
 	u32 s = filter->data;
 	enum rc_type protocol = dev->wakeup_protocol;
 
+	if (protocol >= ARRAY_SIZE(masks))
+		return -EINVAL;
+
 	switch (protocol) {
 	case RC_TYPE_NECX:
 		if ((((s >> 16) ^ ~(s >> 8)) & 0xff) == 0)