The lgdt3306a_calculate_snr_x100() function returns value of type u32.
However it is possible that the calculated SNR value is negative, which
may affect the behaviour of the driver. E.g. lgdt3306a_read_snr() assumes
SNR (x10) can be represented as a value of type u16 so passing negative
32-bit values would result in garbage there.
Since the dvb-frontends API only allows unsigned SNR values,
lgdt3306a_calculate_snr_x100() should return 0 if SNR is negative.
The same way calculate_snr() returns 0 on negative SNR in lgdt330x driver.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: b63b36fa44d0 ("[media] DVB: add support for LG Electronics LGDT3306A ATSC/QAM-B Demodulator")
Signed-off-by: Murad Masimov <m.masimov@xxxxxxxxxxxxxxxxx>
---
drivers/media/dvb-frontends/lgdt3306a.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c
index 6ab9d4de65ce..e6c3b65157e5 100644
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1500,6 +1500,9 @@ static u32 lgdt3306a_calculate_snr_x100(struct lgdt3306a_state *state)
snr_x100 = log10_x1000((pwr * 10000) / mse) - 3000;
dbg_info("mse=%u, pwr=%u, snr_x100=%d\n", mse, pwr, snr_x100);
+ if ((s32)snr_x100 < 0)
+ return 0;
+
return snr_x100;
}
--
2.39.2
