media: rc: validate that "rc_proto" is reasonable

Smatch complains that "rc_proto" comes from the user and it can result
in shift wrapping in ir_raw_encode_scancode()

    drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode()
    error: undefined (user controlled) shift '1 << protocol'

This is true, but I reviewed the surrounding code and it appears
harmless. Anyway, let's verify that "rc_proto" is valid as a kernel
hardening measure.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 220363b..116daf9 100644 (file)
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf,
                        goto out_unlock;
                }
 
-               if (scan.flags || scan.keycode || scan.timestamp) {
+               if (scan.flags || scan.keycode || scan.timestamp ||
+                   scan.rc_proto > RC_PROTO_MAX) {
                        ret = -EINVAL;
                        goto out_unlock;
                }

diff --git a/include/uapi/linux/lirc.h b/include/uapi/linux/lirc.h
index f99d9dc..c1eb960 100644 (file)
--- a/include/uapi/linux/lirc.h
+++ b/include/uapi/linux/lirc.h
@@ -226,6 +226,7 @@ enum rc_proto {
        RC_PROTO_RCMM24         = 25,
        RC_PROTO_RCMM32         = 26,
        RC_PROTO_XBOX_DVD       = 27,
+       RC_PROTO_MAX            = RC_PROTO_XBOX_DVD,
 };
 
 #endif