On Tue Sep 1 17:18:39 2026 +0100, Sean Young wrote:
> Ensure that the low value of the carrier range is smaller than the
> high value. This fixes an underflow in ite_set_rx_carrier_range().
>
> Signed-off-by: Sean Young <[email protected]>
> Acked-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Sean Young
drivers/media/rc/lirc_dev.c | 2 ++
drivers/media/rc/rc-loopback.c | 5 -----
2 files changed, 2 insertions(+), 5 deletions(-)
---
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 183f1939b941..d9b6ecca563f 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -492,6 +492,8 @@ static long lirc_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
ret = -ENOTTY;
else if (val <= 0)
ret = -EINVAL;
+ else if (fh->carrier_low && fh->carrier_low > val)
+ ret = -EINVAL;
else
ret = dev->s_rx_carrier_range(dev, fh->carrier_low,
val);
diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c
index 53d0540717b3..9d56e77c9351 100644
--- a/drivers/media/rc/rc-loopback.c
+++ b/drivers/media/rc/rc-loopback.c
@@ -74,11 +74,6 @@ static int loop_set_rx_carrier_range(struct rc_dev *dev, u32
min, u32 max)
{
struct loopback_dev *lodev = dev->priv;
- if (min < 1 || min > max) {
- dev_dbg(&dev->dev, "invalid rx carrier range %u to %u\n", min,
max);
- return -EINVAL;
- }
-
dev_dbg(&dev->dev, "setting rx carrier range %u to %u\n", min, max);
lodev->rxcarriermin = min;
lodev->rxcarriermax = max;
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
