From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 506932AD37; Fri, 4 Sep 2026 05:42:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788500525; cv=none; b=k/vtO/adsuMVSs7KlON62bVaqo4csEJTOQHWEwHF7qov7pTKhr+LNnkMGRp+eLD9+P5Qr7Yl3CKTTM2b6GqXA1rqaLum5jmR/HY2HJlsP3sD09D2j0jEEfxVbLVrevvSbyF5qGIiQDtl/W+5DON1VRhGAQoIkJtma0L5KmLg4VY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788500525; c=relaxed/simple; bh=lZUrEY4I4+0BW5E7ZGhvdEu/lJZdIb1ep6Ysr9ZRfLI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qB46knWih0zSk7f8NhiOAJl4XxbHjBX8friOeXMGYpMITsOUwUuwvCmsUUFG7yVcM/rNHx3JdwuDfKb6/SfMS46AOronsiDI4Yd7WXxSzlLVfa1jBnh0PzsfBjQou9qEODL441hzutwC3L4/n6iUIa3IiiephRoPHiu5W+7Kf8U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=boAzuJva; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="boAzuJva" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9ABDF1F00A3D; Fri, 4 Sep 2026 05:42:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788500524; bh=yhaUXVFE8KuGp2WqZN37mhSUeyKnLhvCTQ8T3oYfuFk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=boAzuJvaR8XZGsYPaVpfGqVI5/Ir4Ce2ZQNsaiKLGI9cPzTm+B6yTPhYEOcDivOBn f+3sKwr6pp8JycxeBR4Zy0VzdALdUkfD+VxmyBJ1nafqn+lGuogjOwpsJlw+J68LP4 kNfmoAYD1MHX4094uQ9voo8BjdytxPlCgzZozs3s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Weigang He , Hans Verkuil Subject: [PATCH 6.18 088/552] media: cec: stm32: prevent out-of-bounds write on RX overflow Date: Fri, 4 Sep 2026 06:54:05 +0200 Message-ID: <20260904045749.872985461@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045747.813364717@linuxfoundation.org> References: <20260904045747.813364717@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weigang He commit fb9dda38d4b9e90db07ed9a0ee2d35bf85494035 upstream. stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using rx_msg.len as the write index, incrementing it on every RXBR (receive-byte-ready) interrupt without checking it against the buffer size: cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF; rx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct cec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a completed message (RXEND). The number of bytes received before RXEND is decided by the remote CEC device (it sets EOM), not by the driver. A peer that keeps sending bytes without ending the message drives RXBR repeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes out of bounds into the surrounding memory. This is reachable in normal operation once the driver has probed and receiving is enabled, from the IRQ thread, without any local privilege. The length check in the CEC core runs on the consumer side, after the byte has been stored, so it does not prevent the overflow. Bound the index in the driver before the store, as the other platform CEC drivers already do (e.g. tegra_cec), dropping the excess bytes of an overlong frame. Found by static analysis tool CodeQL. Fixes: d69ae57453c8 ("[media] cec: add STM32 cec driver") Cc: stable@vger.kernel.org Signed-off-by: Weigang He Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/cec/platform/stm32/stm32-cec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/media/cec/platform/stm32/stm32-cec.c +++ b/drivers/media/cec/platform/stm32/stm32-cec.c @@ -132,7 +132,8 @@ static void stm32_rx_done(struct stm32_c u32 val; regmap_read(cec->regmap, CEC_RXDR, &val); - cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF; + if (cec->rx_msg.len < CEC_MAX_MSG_SIZE) + cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF; } if (cec->irq_status & RXEND) {