github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: cec: extron: clear response tail before dispatch

Browse Source 
The serial receive buffer is reused between responses. Terminating a
short response with one NUL leaves bytes from the previous response
behind it, while the dispatcher also checks fixed offsets beyond some
prefixes. Those checks can consume stale tail bytes.

Clear up to ten bytes at the end of each completed response, limited by
the remaining array capacity. This includes the terminator and covers
the dispatcher's fixed-offset tests without adding a separate length
condition to every prefix branch.

The issue was found by our static-analysis tool.

Fixes: 056f2821b6 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
Cc: stable@vger.kernel.org
Assisted-by: gpt 5
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Pengpeng Hou 2026-09-20 11:40:10 +08:00 committed by Hans Verkuil
parent 0c795849fd
commit a601427f03
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
View File

@ -847,7 +847,9 @@ static irqreturn_t extron_interrupt(struct serio *serio, unsigned char data,
return IRQ_HANDLED;
memcpy(extron->data, extron->buf, extron->idx);
extron->len = extron->idx;
extron->data[extron->len] = 0;
/* Keep fixed-offset response tests from using stale tail bytes. */
memset(extron->data + extron->len, 0,
min_t(size_t, 10, sizeof(extron->data) - extron->len));
if (debug)
dev_info(extron->dev, "received %s\n", extron->data);
extron->idx = 0;