[media] cec: sanitize msg.flags

The CEC_MSG_FL_REPLY_TO_FOLLOWERS message flag only makes sense for transmitted
messages where you want to wait for the reply.

Clear the flag in all other cases.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

drivers/media/cec/cec-adap.c

@@ -595,6 +595,10 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 		/* Make sure the timeout isn't 0. */
 		msg->timeout = 1000;
 	}
+	if (msg->timeout)
+		msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
+	else
+		msg->flags = 0;
 
 	/* Sanity checks */
 	if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {

drivers/media/cec/cec-api.c

@@ -197,7 +197,6 @@ static long cec_transmit(struct cec_adapter *adap, struct cec_fh *fh,
 	    (msg.len == 1 || msg.msg[1] != CEC_MSG_CDC_MESSAGE))
 		return -EINVAL;
 
-	msg.flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
 	mutex_lock(&adap->lock);
 	if (!adap->is_configured)
 		err = -ENONET;
@@ -282,6 +281,7 @@ static long cec_receive(struct cec_adapter *adap, struct cec_fh *fh,
 	err = cec_receive_msg(fh, &msg, block);
 	if (err)
 		return err;
+	msg.flags = 0;
 	if (copy_to_user(parg, &msg, sizeof(msg)))
 		return -EFAULT;
 	return 0;