Re: [PATCH v3] staging: vme_user: validate slave window size against buffer size

[Greg KH <greg@kroah.com>]

On Sat, May 09, 2026 at 06:07:21PM +0900, Rion Kiguchi wrote:
> The VME_SET_SLAVE ioctl in drivers/staging/vme_user/vme_user.c accepts
> a user-controlled slave.size and forwards it to vme_slave_set() without
> comparing it against image[minor].size_buf. The slave-image kernel
> buffer is allocated at probe time with a fixed size of PCI_BUF_SIZE
> (0x20000 / 128 KiB), but the configured VME window size can be made
> much larger via the ioctl.

<snip>

For some reason you are not using scripts/get_maintainer.pl on your
patch to know who to send this to (hint, it's not the stable email
address...)

> @@ -401,7 +409,6 @@ static int vme_user_ioctl(struct inode *inode, struct file *file,
>  				slave.enable, slave.vme_addr, slave.size,
>  				image[minor].pci_buf, slave.aspace,
>  				slave.cycle);
> -
>  			break;
>  		}
>  		break;

Why was this change made?

thanks,

greg k-h