From a601427f03e015e3d4d2ba44cfa6e0de144983b9 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Sun, 20 Sep 2026 11:40:10 +0800 Subject: [PATCH] media: cec: extron: clear response tail before dispatch The serial receive buffer is reused between responses. Terminating a short response with one NUL leaves bytes from the previous response behind it, while the dispatcher also checks fixed offsets beyond some prefixes. Those checks can consume stale tail bytes. Clear up to ten bytes at the end of each completed response, limited by the remaining array capacity. This includes the terminator and covers the dispatcher's fixed-offset tests without adding a separate length condition to every prefix branch. The issue was found by our static-analysis tool. Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver") Cc: stable@vger.kernel.org Assisted-by: gpt 5 Signed-off-by: Pengpeng Hou Signed-off-by: Hans Verkuil --- .../media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c index 3c6ce6f3d93e..1f8ed7ff31e5 100644 --- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c +++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c @@ -847,7 +847,9 @@ static irqreturn_t extron_interrupt(struct serio *serio, unsigned char data, return IRQ_HANDLED; memcpy(extron->data, extron->buf, extron->idx); extron->len = extron->idx; - extron->data[extron->len] = 0; + /* Keep fixed-offset response tests from using stale tail bytes. */ + memset(extron->data + extron->len, 0, + min_t(size_t, 10, sizeof(extron->data) - extron->len)); if (debug) dev_info(extron->dev, "received %s\n", extron->data); extron->idx = 0;