Commit f15386b3 authored by Hans Verkuil's avatar Hans Verkuil Committed by Zhang Zekun
Browse files

media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags 

stable inclusion
from stable-v4.19.323
commit 4afab2197e530b480c4cc099255d12a08c6a1f93
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4afab2197e530b480c4cc099255d12a08c6a1f93



-------------------------------------------------------------

commit 599f6899051cb70c4e0aa9fd591b9ee220cb6f14 upstream.

The cec_msg_set_reply_to() helper function never zeroed the
struct cec_msg flags field, this can cause unexpected behavior
if flags was uninitialized to begin with.

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 0dbacebe ("[media] cec: move the CEC framework out of staging and to media")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhang Zekun <zhangzekun11@huawei.com>
parent 773f7318

include/uapi/linux/cec.h

+5 −1
Original line number Diff line number Diff line
@@ -132,6 +132,8 @@ static inline void cec_msg_init(struct cec_msg *msg, 
 * Set the msg destination to the orig initiator and the msg initiator to the

 * orig destination. Note that msg and orig may be the same pointer, in which

 * case the change is done in place.

 *

 * It also zeroes the reply, timeout and flags fields.

 */

static inline void cec_msg_set_reply_to(struct cec_msg *msg,

					struct cec_msg *orig)
@@ -139,7 +141,9 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg, 
	/* The destination becomes the initiator and vice versa */

	msg->msg[0] = (cec_msg_destination(orig) << 4) |

		      cec_msg_initiator(orig);

	msg->reply = msg->timeout = 0;

	msg->reply = 0;

	msg->timeout = 0;

	msg->flags = 0;

}



/* cec_msg flags field */