From: Sean Young <sean@mess.org>
Date: Fri, 4 Aug 2017 10:33:41 +0000 (-0400)
Subject: media: winbond-cir: buffer overrun during transmit
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

media: winbond-cir: buffer overrun during transmit

We're reading beyond the buffer before checking its length.

BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---

diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
index ea7be6d35ff8..a18eb232ed81 100644
--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
@@ -429,7 +429,7 @@ wbcir_irq_tx(struct wbcir_data *data)
 		bytes[used] = byte;
 	}
 
-	while (data->txbuf[data->txoff] == 0 && data->txoff != data->txlen)
+	while (data->txoff != data->txlen && data->txbuf[data->txoff] == 0)
 		data->txoff++;
 
 	if (used == 0) {