From: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
commit 576a307a7650bd544fbb24df801b9b7863b85e2f upstream.
as reported by Coverity, if reading SNR registers fail, a negative
number will be returned, causing an underflow when reading SNR
registers.
Prevent that.
Fixes: 8953db793d5b ("V4L/DVB (9178): cx24116: Add module parameter to return SNR as ESNO.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/media/dvb-frontends/cx24116.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/media/dvb-frontends/cx24116.c
+++ b/drivers/media/dvb-frontends/cx24116.c
@@ -753,6 +753,7 @@ static int cx24116_read_snr_pct(struct d
{
struct cx24116_state *state = fe->demodulator_priv;
u8 snr_reading;
+ int ret;
static const u32 snr_tab[] = { /* 10 x Table (rounded up) */
0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667,
0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667,
@@ -761,7 +762,11 @@ static int cx24116_read_snr_pct(struct d
dprintk("%s()\n", __func__);
- snr_reading = cx24116_readreg(state, CX24116_REG_QUALITY0);
+ ret = cx24116_readreg(state, CX24116_REG_QUALITY0);
+ if (ret < 0)
+ return ret;
+
+ snr_reading = ret;
if (snr_reading >= 0xa0 /* 100% */)
*snr = 0xffff;
Patches currently in stable-queue which might be from mchehab+huawei@xxxxxxxxxx are
queue-4.19/media-dvb_frontend-don-t-play-tricks-with-underflow-.patch
queue-4.19/media-cx24116-prevent-overflows-on-snr-calculus.patch
queue-4.19/media-adv7604-prevent-underflow-condition-when-repor.patch
queue-4.19/media-dvbdev-prevent-the-risk-of-out-of-memory-acces.patch
queue-4.19/media-v4l2-tpg-prevent-the-risk-of-a-division-by-zero.patch
queue-4.19/media-s5p-jpeg-prevent-buffer-overflows.patch
queue-4.19/media-stb0899_algo-initialize-cfr-before-using-it.patch
