media: cec: avoid decrementing transmit_queue_sz if it is 0 (95c29d46) · Commits · 戴 / test

WARN if transmit_queue_sz is 0 but do not decrement it. The CEC adapter will become unresponsive if it goes below 0 since then it thinks there are 4 billion messages in the queue. Obviously this should not happen, but a driver bug could cause this. Signed-off-by:

Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: <stable@vger.kernel.org> # for v4.12 and up Signed-off-by:

Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

drivers/media/cec/cec-adap.c

+12 −2

Original line number	Diff line number	Diff line
		@@ -380,6 +380,7 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status)
		} else {
		list_del_init(&data->list);
		if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
		if (!WARN_ON(!data->adap->transmit_queue_sz))
		data->adap->transmit_queue_sz--;
		}

		@@ -432,6 +433,14 @@ static void cec_flush(struct cec_adapter *adap)
		* need to do anything special in that case.
		*/
		}
		/*
		* If something went wrong and this counter isn't what it should
		* be, then this will reset it back to 0. Warn if it is not 0,
		* since it indicates a bug, either in this framework or in a
		* CEC driver.
		*/
		if (WARN_ON(adap->transmit_queue_sz))
		adap->transmit_queue_sz = 0;
		}

		/*
		@@ -522,6 +531,7 @@ int cec_thread_func(void *_adap)
		data = list_first_entry(&adap->transmit_queue,
		struct cec_data, list);
		list_del_init(&data->list);
		if (!WARN_ON(!data->adap->transmit_queue_sz))
		adap->transmit_queue_sz--;

		/* Make this the current transmitting message */

Admin message