From: Sean Young <sean@mess.org>
To: linux-media@vger.kernel.org, Sean Young <sean@mess.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Rik van Riel <riel@surriel.com>,
stable@vger.kernel.org,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
linux-kernel@vger.kernel.org
Subject: [PATCH v5 19/20] media: ir_toy: Validate the maximum tx carrier
Date: Tue, 15 Sep 2026 09:32:29 +0100 [thread overview]
Message-ID: <36f7ad6de88697d39a3ab1729aabd856cfd1d81c.1789460680.git.sean@mess.org> (raw)
In-Reply-To: <cover.1789460680.git.sean@mess.org>
Reject any carrier the hardware cannot generate. This also fixes
a divide by zero if a carrier of U32_MAX/16 is set.
Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
---
drivers/media/rc/ir_toy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
index 286c8543aa5a..58b23d08a897 100644
--- a/drivers/media/rc/ir_toy.c
+++ b/drivers/media/rc/ir_toy.c
@@ -372,7 +372,7 @@ static int irtoy_tx_carrier(struct rc_dev *rc, uint32_t carrier)
u8 buf[3];
int err;
- if (carrier < 11800)
+ if (carrier < 11800 || carrier > 3000000)
return -EINVAL;
buf[0] = 0x06;
--
2.55.0
next prev parent reply other threads:[~2026-09-15 8:33 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1789460680.git.sean@mess.org>
2026-09-15 8:32 ` [PATCH v5 01/20] media: rc: Ensure registered is cleared in error path Sean Young
2026-09-15 8:32 ` [PATCH v5 02/20] media: rc: Ensure that rc_unregister_device() does not free input device Sean Young
2026-09-15 8:32 ` [PATCH v5 03/20] media: rc: Fix ABBA deadlock by making locks more fine grained Sean Young
2026-09-15 8:32 ` [PATCH v5 04/20] media: rc: Replace open coded krealloc() for keymap Sean Young
2026-09-15 13:07 ` Hans Verkuil
2026-09-15 14:56 ` Sean Young
2026-09-15 15:43 ` Sean Young
2026-09-22 11:22 ` Hans Verkuil
2026-09-15 8:32 ` [PATCH v5 05/20] media: rc: Add missing locking " Sean Young
2026-09-15 8:32 ` [PATCH v5 06/20] media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister Sean Young
2026-09-15 8:32 ` [PATCH v5 07/20] media: rc: mce_kbd: Fix inconsistent locking of keylock Sean Young
2026-09-15 8:32 ` [PATCH v5 08/20] media: ene_ir: Ensure teardown is done in the correct order Sean Young
2026-09-15 8:32 ` [PATCH v5 09/20] media: rc: Use binary search for adding or updating a scancode Sean Young
2026-09-15 8:32 ` [PATCH v5 10/20] media: rc: imon: Bind both interfaces via usb_driver_claim_interface() Sean Young
2026-09-15 8:32 ` [PATCH v5 11/20] media: ir_toy: Remove unused struct field Sean Young
2026-09-15 8:32 ` [PATCH v5 12/20] media: nuvoton-cir: " Sean Young
2026-09-15 8:32 ` [PATCH v5 13/20] media: ite-cir: Removed " Sean Young
2026-09-15 8:32 ` [PATCH v5 14/20] media: fintek-cir: Remove unused fields Sean Young
2026-09-15 8:32 ` [PATCH v5 15/20] media: mceusb: Remove unused field Sean Young
2026-09-15 8:32 ` [PATCH v5 16/20] media: serial_ir: Fix race condition where timer can be re-armed Sean Young
2026-09-15 8:32 ` [PATCH v5 17/20] media: rc: After rc_unregister_device() timers " Sean Young
2026-09-15 8:32 ` [PATCH v5 18/20] media: rc: Validate carrier range in LIRC_SET_REC_CARRIER ioctl Sean Young
2026-09-15 8:32 ` Sean Young [this message]
2026-09-15 8:32 ` [PATCH v5 20/20] media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() Sean Young
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=36f7ad6de88697d39a3ab1729aabd856cfd1d81c.1789460680.git.sean@mess.org \
--to=sean@mess.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=mchehab@kernel.org \
--cc=riel@surriel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®