| From 9dec0f48a75e0dadca498002d25ef4e143e60194 Mon Sep 17 00:00:00 2001 |
| From: Sean Young <sean@mess.org> |
| Date: Tue, 19 Jan 2021 14:53:50 +0100 |
| Subject: media: mceusb: sanity check for prescaler value |
| |
| From: Sean Young <sean@mess.org> |
| |
| commit 9dec0f48a75e0dadca498002d25ef4e143e60194 upstream. |
| |
| prescaler larger than 8 would mean the carrier is at most 152Hz, |
| which does not make sense for IR carriers. |
| |
| Reported-by: syzbot+6d31bf169a8265204b8d@syzkaller.appspotmail.com |
| Signed-off-by: Sean Young <sean@mess.org> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/media/rc/mceusb.c | 9 ++++++++- |
| 1 file changed, 8 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/media/rc/mceusb.c |
| +++ b/drivers/media/rc/mceusb.c |
| @@ -701,11 +701,18 @@ static void mceusb_dev_printdata(struct |
| data[0], data[1]); |
| break; |
| case MCE_RSP_EQIRCFS: |
| + if (!data[0] && !data[1]) { |
| + dev_dbg(dev, "%s: no carrier", inout); |
| + break; |
| + } |
| + // prescaler should make sense |
| + if (data[0] > 8) |
| + break; |
| period = DIV_ROUND_CLOSEST((1U << data[0] * 2) * |
| (data[1] + 1), 10); |
| if (!period) |
| break; |
| - carrier = (1000 * 1000) / period; |
| + carrier = USEC_PER_SEC / period; |
| dev_dbg(dev, "%s carrier of %u Hz (period %uus)", |
| inout, carrier, period); |
| break; |