From 72e637fec558c7842d6f1508f480fd77c20afe3a Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 30 Oct 2020 12:52:30 +0100 Subject: media: rc: validate that "rc_proto" is reasonable Smatch complains that "rc_proto" comes from the user and it can result in shift wrapping in ir_raw_encode_scancode() drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode() error: undefined (user controlled) shift '1 << protocol' This is true, but I reviewed the surrounding code and it appears harmless. Anyway, let's verify that "rc_proto" is valid as a kernel hardening measure. Signed-off-by: Dan Carpenter Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/lirc_dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/media/rc/lirc_dev.c') diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 220363b9a868..116daf90c858 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf, goto out_unlock; } - if (scan.flags || scan.keycode || scan.timestamp) { + if (scan.flags || scan.keycode || scan.timestamp || + scan.rc_proto > RC_PROTO_MAX) { ret = -EINVAL; goto out_unlock; } -- cgit v1.2.3-59-g8ed1b