[PATCH 4/4] staging: vc04_services: vchiq-mmal: fix integer underflow in port_parameter_get()

Sebastian Josue Alba Vives
2026-03-29T06:22:58Z

port_parameter_get() subtracts 2 * sizeof(u32) from the GPU firmware's
reply size field to compute the parameter value size. The reply size is
a u32 provided by the VideoCore firmware. If the firmware returns a
size smaller than 8, the subtraction wraps around to a large value due
to unsigned integer underflow.

The underflowed size is then:
1) Used in a comparison that selects the wrong copy path
2) Stored back to the caller via *value_size, propagating a bogus
size (up to ~4GB) to subsequent operations

Add a minimum size check before the subtraction and return -EPROTO if
the reply is malformed.

Fixes: b18ee53ad297 ("staging: bcm2835: Break MMAL support out from camera")
Signed-off-by: Sebastián Alba Vives <sebasjosue84@gmail.com>
---
drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 11af71309..914ab9215 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1436,6 +1436,10 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
/* port_parameter_get_reply.size includes the header,
* whilst *value_size doesn't.
*/
+ if (rmsg->u.port_parameter_get_reply.size < (2 * sizeof(u32))) {
+ ret = -EPROTO;
+ goto release_msg;
+ }
rmsg->u.port_parameter_get_reply.size -= (2 * sizeof(u32));

if (ret || rmsg->u.port_parameter_get_reply.size > *value_size) {
--
2.43.0