* [PATCH] media: synopsys: hdmirx: fix integer overflow in hdmirx_get_edid()
@ 2026-01-08 20:03 Dan Carpenter
2026-01-08 22:26 ` Dmitry Osipenko
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2026-01-08 20:03 UTC (permalink / raw)
To: Shreeya Patel
Cc: Dmitry Osipenko, Mauro Carvalho Chehab, Dingxian Wen,
Hans Verkuil, linux-media, kernel, linux-kernel, kernel-janitors
The "edid->blocks" variable comes from the user via the ioctl. It's
a u32 and "edid->start_block" is a u32 too. The addition operation
could have an integer wrapping bug, so use the size_add() function to
prevent that.
Cc: stable@vger.kernel.org
Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index c3007e09bc9f..f054e30cbfb0 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -717,7 +717,7 @@ static int hdmirx_get_edid(struct file *file, void *fh, struct v4l2_edid *edid)
if (edid->start_block >= hdmirx_dev->edid_blocks_written || !edid->blocks)
return -EINVAL;
- if (edid->start_block + edid->blocks > hdmirx_dev->edid_blocks_written)
+ if (size_add(edid->start_block, edid->blocks) > hdmirx_dev->edid_blocks_written)
edid->blocks = hdmirx_dev->edid_blocks_written - edid->start_block;
memcpy(edid->edid, hdmirx_dev->edid, edid->blocks * EDID_BLOCK_SIZE);
--
2.51.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] media: synopsys: hdmirx: fix integer overflow in hdmirx_get_edid()
2026-01-08 20:03 [PATCH] media: synopsys: hdmirx: fix integer overflow in hdmirx_get_edid() Dan Carpenter
@ 2026-01-08 22:26 ` Dmitry Osipenko
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Osipenko @ 2026-01-08 22:26 UTC (permalink / raw)
To: Dan Carpenter
Cc: Mauro Carvalho Chehab, Dingxian Wen, Hans Verkuil, linux-media,
kernel, linux-kernel, kernel-janitors
On 1/8/26 23:03, Dan Carpenter wrote:
> The "edid->blocks" variable comes from the user via the ioctl. It's
> a u32 and "edid->start_block" is a u32 too. The addition operation
> could have an integer wrapping bug, so use the size_add() function to
> prevent that.
>
> Cc: stable@vger.kernel.org
> Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
> index c3007e09bc9f..f054e30cbfb0 100644
> --- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
> +++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
> @@ -717,7 +717,7 @@ static int hdmirx_get_edid(struct file *file, void *fh, struct v4l2_edid *edid)
> if (edid->start_block >= hdmirx_dev->edid_blocks_written || !edid->blocks)
> return -EINVAL;
>
> - if (edid->start_block + edid->blocks > hdmirx_dev->edid_blocks_written)
> + if (size_add(edid->start_block, edid->blocks) > hdmirx_dev->edid_blocks_written)
> edid->blocks = hdmirx_dev->edid_blocks_written - edid->start_block;
>
> memcpy(edid->edid, hdmirx_dev->edid, edid->blocks * EDID_BLOCK_SIZE);
Acked-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
--
Best regards,
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-01-08 22:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-08 20:03 [PATCH] media: synopsys: hdmirx: fix integer overflow in hdmirx_get_edid() Dan Carpenter
2026-01-08 22:26 ` Dmitry Osipenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox