Re: [patch v2] [media] rc-core: prevent divide by zero bug in s_tx_carrier()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, 2012-09-09 at 23:26 +0100, Sean Young wrote:
> On Sun, Sep 09, 2012 at 11:31:42PM +0300, Dan Carpenter wrote:
> > Several of the drivers use carrier as a divisor in their s_tx_carrier()
> > functions.  We should do a sanity check here like we do for
> > LIRC_SET_REC_CARRIER.
> > 
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> > ---
> > v2: Ben Hutchings pointed out that my first patch was not a complete
> >     fix.
> > 
> > diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
> > index 6ad4a07..28dc0f0 100644
> > --- a/drivers/media/rc/ir-lirc-codec.c
> > +++ b/drivers/media/rc/ir-lirc-codec.c
> > @@ -211,6 +211,9 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
> >  		if (!dev->s_tx_carrier)
> >  			return -EINVAL;
> 
> This should be ENOSYS.
> 
> >  
> > +		if (val <= 0)
> > +			return -EINVAL;
> > +
> 
> 1) val is unsigned so it would never be less than zero.
> 
> 2) A value of zero means disabling carrier modulation, which is used by 
>    the mceusb driver.
>
> So the check belongs in the individual drivers, as in the original patch.

Oh well, sorry for pointing Dan in the wrong direction.  Is the special
case documented somewhere?

Ben.

-- 
Ben Hutchings
Time is nature's way of making sure that everything doesn't happen at once.

Attachment: signature.asc
Description: This is a digitally signed message part


[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux