diff options
| author | Sean Young <sean@mess.org> | 2019-11-10 11:04:40 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-05 13:03:39 +0000 |
| commit | 299ec5f621f9668b7a84fbe7e16b9176af22212d (patch) | |
| tree | eb01c09fc7c8f3cdb81ab2b6d8e4548ecd86eab9 | |
| parent | 37f739275ff4160df79029087fe1e0452f56899d (diff) | |
| download | linux-299ec5f621f9668b7a84fbe7e16b9176af22212d.tar.gz linux-299ec5f621f9668b7a84fbe7e16b9176af22212d.tar.bz2 linux-299ec5f621f9668b7a84fbe7e16b9176af22212d.zip | |
media: digitv: don't continue if remote control state can't be read
commit eecc70d22ae51225de1ef629c1159f7116476b2e upstream.
This results in an uninitialized variable read.
Reported-by: syzbot+6bf9606ee955b646c0e1@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/media/usb/dvb-usb/digitv.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c index 772bde3c5020..4a817363a33b 100644 --- a/drivers/media/usb/dvb-usb/digitv.c +++ b/drivers/media/usb/dvb-usb/digitv.c @@ -226,18 +226,22 @@ static struct rc_map_table rc_map_digitv_table[] = { static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state) { - int i; + int ret, i; u8 key[5]; u8 b[4] = { 0 }; *event = 0; *state = REMOTE_NO_KEY_PRESSED; - digitv_ctrl_msg(d,USB_READ_REMOTE,0,NULL,0,&key[1],4); + ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, &key[1], 4); + if (ret) + return ret; /* Tell the device we've read the remote. Not sure how necessary this is, but the Nebula SDK does it. */ - digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0); + ret = digitv_ctrl_msg(d, USB_WRITE_REMOTE, 0, b, 4, NULL, 0); + if (ret) + return ret; /* if something is inside the buffer, simulate key press */ if (key[1] != 0) |