[PATCH 0/2] One fix, one license change

[PATCH 0/2] One fix, one license change

[Hans Verkuil]

Dual license the CEC headers, just as we do for videodev2.h.
Also fix an array out-of-bounds bug.

Hans Verkuil (2):
  cec.h/cec-funcs.h: add option to use BSD license
  cec-adap: prevent write to out-of-bounds array index

 drivers/staging/media/cec/cec-adap.c | 13 ++++++++-----
 include/linux/cec-funcs.h            | 16 ++++++++++++++++
 include/linux/cec.h                  | 16 ++++++++++++++++
 3 files changed, 40 insertions(+), 5 deletions(-)

-- 
2.7.0

[PATCH 1/2] cec.h/cec-funcs.h: add option to use BSD license

[Hans Verkuil]

Like the videodev2.h and other headers, explicitly allow these headers
to be used with the BSD license.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
---
 include/linux/cec-funcs.h | 16 ++++++++++++++++
 include/linux/cec.h       | 16 ++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/include/linux/cec-funcs.h b/include/linux/cec-funcs.h
index 8ee1029..19486009 100644
--- a/include/linux/cec-funcs.h
+++ b/include/linux/cec-funcs.h
@@ -7,6 +7,22 @@
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; version 2 of the License.
  *
+ * Alternatively you can redistribute this file under the terms of the
+ * BSD license as stated below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. The names of its contributors may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
diff --git a/include/linux/cec.h b/include/linux/cec.h
index 40924e7..6678afe 100644
--- a/include/linux/cec.h
+++ b/include/linux/cec.h
@@ -7,6 +7,22 @@
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; version 2 of the License.
  *
+ * Alternatively you can redistribute this file under the terms of the
+ * BSD license as stated below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. The names of its contributors may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-- 
2.7.0

[PATCH 2/2] cec-adap: prevent write to out-of-bounds array index

[Hans Verkuil]

CEC_MSG_REPORT_PHYSICAL_ADDR can theoretically be received from
an unregistered device, but in that case the code should not attempt
to write the received physical address to the phys_addrs array.

That would be pointless since there can be multiple unregistered
devices that report a physical address. We just ignore those.

While at it, improve the dprintk since it would attempt to read
from that array as well with the same out-of-bounds problem.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/staging/media/cec/cec-adap.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c
index 98bdcf9..307af43 100644
--- a/drivers/staging/media/cec/cec-adap.c
+++ b/drivers/staging/media/cec/cec-adap.c
@@ -1442,12 +1442,15 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
 
 	switch (msg->msg[1]) {
 	/* The following messages are processed but still passed through */
-	case CEC_MSG_REPORT_PHYSICAL_ADDR:
-		adap->phys_addrs[init_laddr] =
-			(msg->msg[2] << 8) | msg->msg[3];
-		dprintk(1, "Reported physical address %04x for logical address %d\n",
-			adap->phys_addrs[init_laddr], init_laddr);
+	case CEC_MSG_REPORT_PHYSICAL_ADDR: {
+		u16 pa = (msg->msg[2] << 8) | msg->msg[3];
+
+		if (!from_unregistered)
+			adap->phys_addrs[init_laddr] = pa;
+		dprintk(1, "Reported physical address %x.%x.%x.%x for logical address %d\n",
+			cec_phys_addr_exp(pa), init_laddr);
 		break;
+	}
 
 	case CEC_MSG_USER_CONTROL_PRESSED:
 		if (!(adap->capabilities & CEC_CAP_RC))
-- 
2.7.0