7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weigang He commit d1febef1bcfa7bbc401729f994c375b91a833911 upstream. fintek_get_rx_ir_data() drains the CIR RX FIFO into fintek->buf[], which holds RX_BUF_LEN (32) bytes, for as long as CIR_STATUS reports pending RX data: do { sample = fintek_cir_reg_read(fintek, CIR_RX_DATA); ... fintek->buf[fintek->pkts] = sample; fintek->pkts++; ... } while (status & rx_irqs); Nothing bounds fintek->pkts. If the hardware reports data for more than RX_BUF_LEN reads in one interrupt, the loop writes past the end of buf[], starting with the pkts counter that follows it in struct fintek_dev. Hand a full buffer to fintek_process_rx_ir_data(), which parses the samples and resets fintek->pkts, before storing the next sample. This keeps the parser state consistent and drops no samples. The loop still relies on the status register to terminate. The driver does not document the hardware FIFO depth, so it is not known whether a working device can trigger this. Found by static analysis tool CodeQL. Fixes: 9bdc79ea07d9 ("[media] fintek-cir: new driver for Fintek LPC SuperIO CIR function") Cc: stable@vger.kernel.org Assisted-by: LLM codeql Signed-off-by: Weigang He Signed-off-by: Sean Young Signed-off-by: Greg Kroah-Hartman --- drivers/media/rc/fintek-cir.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/media/rc/fintek-cir.c +++ b/drivers/media/rc/fintek-cir.c @@ -340,6 +340,10 @@ static void fintek_get_rx_ir_data(struct sample = fintek_cir_reg_read(fintek, CIR_RX_DATA); fit_dbg("%s: sample: 0x%02x", __func__, sample); + /* Process a full buffer before storing the next sample. */ + if (fintek->pkts >= RX_BUF_LEN) + fintek_process_rx_ir_data(fintek); + fintek->buf[fintek->pkts] = sample; fintek->pkts++;