[PATCH v2 3/4] staging: vc04_services: vchiq-mmal: prevent stack overflow in port_parameter_set()

Sebastian Josue Alba Vives
2026-03-29T07:16:38Z

port_parameter_set() copies value_size bytes from the caller-supplied
value buffer into the stack-allocated struct mmal_msg's
port_parameter_set.value field, which is u32[96] (384 bytes). There is
no bounds check on value_size before the memcpy.

While current in-tree callers pass small fixed-size structures, the
function is exported via EXPORT_SYMBOL_GPL and accessible to any GPL
kernel module. A caller passing value_size > 384 would overflow the
stack-allocated mmal_msg structure.

Add a bounds check rejecting value_size larger than the value field.

Cc: stable@vger.kernel.org
Fixes: b18ee53ad297 ("staging: bcm2835: Break MMAL support out from camera")
Signed-off-by: Sebastián Alba Vives <sebasjosue84@gmail.com>
---
drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 44e5246f1..18e805b92 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1361,6 +1361,14 @@ static int port_parameter_set(struct vchiq_mmal_instance *instance,
struct mmal_msg *rmsg;
struct vchiq_header *rmsg_handle;

+ if (value_size >
+ sizeof(m.u.port_parameter_set.value)) {
+ pr_err_ratelimited("port_parameter_set: value_size %u exceeds max %zu\n",
+ value_size,
+ sizeof(m.u.port_parameter_set.value));
+ return -EINVAL;
+ }
+
m.h.type = MMAL_MSG_TYPE_PORT_PARAMETER_SET;

m.u.port_parameter_set.component_handle = port->component->handle;
--
2.43.0