6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sean Young [ Upstream commit 27303392aa87b61692faadec8b00e0ca66bf98dd ] Reject any carrier the hardware cannot generate. This also fixes a divide by zero if a carrier of U32_MAX/16 is set. Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set") Cc: stable@vger.kernel.org Signed-off-by: Sean Young Acked-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/rc/ir_toy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c index e79de56997a42..ba6c042127078 100644 --- a/drivers/media/rc/ir_toy.c +++ b/drivers/media/rc/ir_toy.c @@ -373,7 +373,7 @@ static int irtoy_tx_carrier(struct rc_dev *rc, uint32_t carrier) u8 buf[3]; int err; - if (carrier < 11800) + if (carrier < 11800 || carrier > 3000000) return -EINVAL; buf[0] = 0x06; -- 2.53.0