Patch "media: rc: check for integer overflow" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

media: rc: check for integer overflow

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
media-rc-check-for-integer-overflow.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Sean Young <[email protected]>
Date: Sun, 8 Oct 2017 14:18:52 -0400
Subject: media: rc: check for integer overflow

From: Sean Young <[email protected]>

commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream.

The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called with a timeout of 4294968us.

---
 drivers/media/rc/ir-lirc-codec.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

@@ -289,11 +289,14 @@ static long ir_lirc_ioctl(struct file *f
 		if (!dev->max_timeout)
 			return -ENOSYS;
 
+		/* Check for multiply overflow */
+		if (val > U32_MAX / 1000)
+			return -EINVAL;
+
 		tmp = val * 1000;
 
-		if (tmp < dev->min_timeout ||
-		    tmp > dev->max_timeout)
-				return -EINVAL;
+		if (tmp < dev->min_timeout || tmp > dev->max_timeout)
+			return -EINVAL;
 
 		dev->timeout = tmp;
 		break;

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/media-rc-check-for-integer-overflow.patch