From e252955466d7605921c7c99f97e5b4d234938a11 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Tue, 1 Sep 2026 17:18:39 +0100 Subject: [PATCH] media: rc: Validate carrier range in LIRC_SET_REC_CARRIER ioctl Ensure that the low value of the carrier range is smaller than the high value. This fixes an underflow in ite_set_rx_carrier_range(). Signed-off-by: Sean Young Acked-by: Hans Verkuil --- drivers/media/rc/lirc_dev.c | 2 ++ drivers/media/rc/rc-loopback.c | 5 ----- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 183f1939b941..d9b6ecca563f 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -492,6 +492,8 @@ static long lirc_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ret = -ENOTTY; else if (val <= 0) ret = -EINVAL; + else if (fh->carrier_low && fh->carrier_low > val) + ret = -EINVAL; else ret = dev->s_rx_carrier_range(dev, fh->carrier_low, val); diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c index 53d0540717b3..9d56e77c9351 100644 --- a/drivers/media/rc/rc-loopback.c +++ b/drivers/media/rc/rc-loopback.c @@ -74,11 +74,6 @@ static int loop_set_rx_carrier_range(struct rc_dev *dev, u32 min, u32 max) { struct loopback_dev *lodev = dev->priv; - if (min < 1 || min > max) { - dev_dbg(&dev->dev, "invalid rx carrier range %u to %u\n", min, max); - return -EINVAL; - } - dev_dbg(&dev->dev, "setting rx carrier range %u to %u\n", min, max); lodev->rxcarriermin = min; lodev->rxcarriermax = max;