[PATCH v2 2/4] staging: vc04_services: vchiq-mmal: add buffer size check in inline_receive()

Sebastian Josue Alba Vives
2026-03-29T07:16:35Z

inline_receive() copies payload data from a VCHIQ message into a
destination buffer using payload_in_message as the copy length, but
never validates that this length fits within the destination buffer
(msg_context->u.bulk.buffer->buffer_size).

While the caller validates payload_in_message <= MMAL_VC_SHORT_DATA
(128) to prevent overreading the source, the destination buffer may be
smaller than 128 bytes. This is inconsistent with bulk_receive() which
does check buffer_size before copying.

Add a bounds check against buffer_size and truncate the copy length if
it exceeds the destination capacity, matching the defensive pattern used
in bulk_receive(). Use pr_warn_ratelimited() for the truncation warning.

Cc: stable@vger.kernel.org
Fixes: b18ee53ad297 ("staging: bcm2835: Break MMAL support out from camera")
Signed-off-by: Sebastián Alba Vives <sebasjosue84@gmail.com>
---
.../vc04_services/vchiq-mmal/mmal-vchiq.c | 20 ++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 9c6533f82..44e5246f1 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -368,12 +368,26 @@ static int inline_receive(struct vchiq_mmal_instance *instance,
struct mmal_msg *msg,
struct mmal_msg_context *msg_context)
{
+ u32 payload_len = msg->u.buffer_from_host.payload_in_message;
+
+ /*
+ * Ensure the payload fits within the destination buffer.
+ * The caller already validates payload_len <= MMAL_VC_SHORT_DATA
+ * against the source, but the destination buffer may be smaller.
+ * bulk_receive() performs this check; inline_receive() must too.
+ */
+ if (payload_len > msg_context->u.bulk.buffer->buffer_size) {
+ payload_len = msg_context->u.bulk.buffer->buffer_size;
+ pr_warn_ratelimited("inline_receive: payload truncated (%u > %lu)\n",
+ msg->u.buffer_from_host.payload_in_message,
+ msg_context->u.bulk.buffer->buffer_size);
+ }
+
memcpy(msg_context->u.bulk.buffer->buffer,
msg->u.buffer_from_host.short_data,
- msg->u.buffer_from_host.payload_in_message);
+ payload_len);

- msg_context->u.bulk.buffer_used =
- msg->u.buffer_from_host.payload_in_message;
+ msg_context->u.bulk.buffer_used = payload_len;

return 0;
}
--
2.43.0