On Sun Sep 20 11:40:10 2026 +0800, Pengpeng Hou wrote:
> The serial receive buffer is reused between responses. Terminating a
> short response with one NUL leaves bytes from the previous response
> behind it, while the dispatcher also checks fixed offsets beyond some
> prefixes. Those checks can consume stale tail bytes.
>
> Clear up to ten bytes at the end of each completed response, limited by
> the remaining array capacity. This includes the terminator and covers
> the dispatcher's fixed-offset tests without adding a separate length
> condition to every prefix branch.
>
> The issue was found by our static-analysis tool.
>
> Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD
> 4K Plus CEC driver")
> Cc: [email protected]
> Assisted-by: gpt 5
> Signed-off-by: Pengpeng Hou <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
index 3c6ce6f3d93e..1f8ed7ff31e5 100644
--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
+++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
@@ -847,7 +847,9 @@ static irqreturn_t extron_interrupt(struct serio *serio,
unsigned char data,
return IRQ_HANDLED;
memcpy(extron->data, extron->buf, extron->idx);
extron->len = extron->idx;
- extron->data[extron->len] = 0;
+ /* Keep fixed-offset response tests from using stale tail
bytes. */
+ memset(extron->data + extron->len, 0,
+ min_t(size_t, 10, sizeof(extron->data) - extron->len));
if (debug)
dev_info(extron->dev, "received %s\n", extron->data);
extron->idx = 0;
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
