From 27303392aa87b61692faadec8b00e0ca66bf98dd Mon Sep 17 00:00:00 2001 From: Sean Young Date: Fri, 4 Sep 2026 10:09:16 +0100 Subject: [PATCH] media: ir_toy: Validate the maximum tx carrier Reject any carrier the hardware cannot generate. This also fixes a divide by zero if a carrier of U32_MAX/16 is set. Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set") Cc: stable@vger.kernel.org Signed-off-by: Sean Young Acked-by: Hans Verkuil --- drivers/media/rc/ir_toy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c index 286c8543aa5a..58b23d08a897 100644 --- a/drivers/media/rc/ir_toy.c +++ b/drivers/media/rc/ir_toy.c @@ -372,7 +372,7 @@ static int irtoy_tx_carrier(struct rc_dev *rc, uint32_t carrier) u8 buf[3]; int err; - if (carrier < 11800) + if (carrier < 11800 || carrier > 3000000) return -EINVAL; buf[0] = 0x06;