lkml.org 
[lkml]   [2020]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.5 15/23] media: digitv: dont continue if remote control state cant be read
    Date
    From: Sean Young <sean@mess.org>

    commit eecc70d22ae51225de1ef629c1159f7116476b2e upstream.

    This results in an uninitialized variable read.

    Reported-by: syzbot+6bf9606ee955b646c0e1@syzkaller.appspotmail.com
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/dvb-usb/digitv.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    --- a/drivers/media/usb/dvb-usb/digitv.c
    +++ b/drivers/media/usb/dvb-usb/digitv.c
    @@ -230,18 +230,22 @@ static struct rc_map_table rc_map_digitv

    static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
    {
    - int i;
    + int ret, i;
    u8 key[5];
    u8 b[4] = { 0 };

    *event = 0;
    *state = REMOTE_NO_KEY_PRESSED;

    - digitv_ctrl_msg(d,USB_READ_REMOTE,0,NULL,0,&key[1],4);
    + ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, &key[1], 4);
    + if (ret)
    + return ret;

    /* Tell the device we've read the remote. Not sure how necessary
    this is, but the Nebula SDK does it. */
    - digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0);
    + ret = digitv_ctrl_msg(d, USB_WRITE_REMOTE, 0, b, 4, NULL, 0);
    + if (ret)
    + return ret;

    /* if something is inside the buffer, simulate key press */
    if (key[1] != 0)

    \
     
     \ /
      Last update: 2020-02-03 17:40    [W:7.577 / U:0.348 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site