From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063108; b=ITjPU8v7PoeXpXVSCgh1HiitY0lyz7aYJlKaUUDaqYejN3R6PJxiH4Sf/BYzjU3P92Gr AzDyT/RUQlFtwzW9qS6k3kd7TFQ3YIktMplQSk4ey5s0dNks2y8nR/r7ZzwhsDFSDRRqh pIOu9NRIwVtea86/BZDQMU+OBLSbQ9HOakeXdSJD9fTzYW0YCd4JGEszh//k0Dcqu/Gev 92NIUv4xcKoBTFfAtAeXQQs+NKqJP0yA01+87ARuDERXQMqCmNcAppPyJL/ICZmJ6g+uM 8B8DhRMMQtk4+50kaKOpr8sXRur6E3x0mHllR61nj7QYnkfG1R2O9nX3WXaWevTBTSw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063108; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=3UVB3YKySoZKuOV7PxcAVkYu/FhgZuHbJt6lLQawYzI=; b=jl0s6x9Zjg//zckVj8hL44YnM1R2MjKRcPVrVOcJzHZ3kGpkl3banqKzYJ4ZY5LO6uu4 1kjA7ufu2yLjhqkRefJ+pPRcEBwQe15djQKGFHNUyh5HKppUzcOMvNJ8sdruBna+QDO30 qTPPbvINS1KigpXnupYRCXRxSwKchZISm+nzJ1e6heEY0jj34pjmaqa1RB+S11JvyAhgr MdsKUb0OtkLZEzOz5Uv+pjHRRBse99NN9Jz3Z+WIzDW4uRNeTYtH4YJTIn2pBxUG40jWX T4EoXzz1aMGlPDV3tFPYNkLYGvwMq1nulY40ZerUStl699vulcH7u0cnq0iPa6CX11Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=c4H7HF5h; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15FCB606A33B; Sat, 7 Nov 2026 14:51:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=c4H7HF5h Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9D7C41F0089F; Sat, 7 Nov 2026 14:51:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063107; bh=3UVB3YKySoZKuOV7PxcAVkYu/FhgZuHbJt6lLQawYzI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=c4H7HF5hdO3rzyneg47n2muGRRXGnVb6mjj4PGzHY3Td+HzVtD6AdnkbSaKQXUMcL L7UAhteo1dOneucxXVdYruR+84kJj5mpq3LWl1gY5RAwnXNPLTnMek3w5VbQh7PL0Y E8W99GPAz5IhvYTWuQGcFeOwQfMZMcStxTvZ+Cls= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Runyu Xiao , Nicolas Dufresne , Hans Verkuil , Sasha Levin Subject: [PATCH 6.18 340/869] media: sti: delta: use unaligned accessors for MJPEG SOF fields Date: Sat, 7 Nov 2026 08:50:22 -0500 Message-ID: <20261107134903.919220563@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Runyu Xiao [ Upstream commit fdc5bf02aeaef04e7d13895db9b6eaf8083953f9 ] delta_mjpeg_read_header() scans a compressed MJPEG access unit byte by byte and passes the bytes after an SOF marker to delta_mjpeg_read_sof(). The SOF parser then reads 16-bit big-endian fields directly from that byte stream. The SOF payload is not an aligned object. The marker scan can find the payload at any byte position, and the SOF layout also puts frame_height and frame_width after a one-byte sample_precision field. Those fields therefore sit at odd offsets within the payload even when the payload base happens to be 2-byte aligned. Avoid casting the byte stream to __be16 pointers and use get_unaligned_be16() for the SOF length, height, and width fields. This issue was detected by our static analysis tool and confirmed by manual audit. A focused UBSAN alignment validation of the same typed load shape reported a misaligned __be16 access in delta_mjpeg_read_sof(). Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c index 90e5b2f72c82b..849a5e118aec4 100644 --- a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c +++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c @@ -4,6 +4,7 @@ * Author: Hugues Fruchet for STMicroelectronics. */ +#include #include "delta.h" #include "delta-mjpeg.h" @@ -48,13 +49,13 @@ static int delta_mjpeg_read_sof(struct delta_ctx *pctx, goto err_no_more; memset(header, 0, sizeof(*header)); - header->length = be16_to_cpu(*(__be16 *)(data + offset)); + header->length = get_unaligned_be16(data + offset); offset += sizeof(u16); header->sample_precision = *(u8 *)(data + offset); offset += sizeof(u8); - header->frame_height = be16_to_cpu(*(__be16 *)(data + offset)); + header->frame_height = get_unaligned_be16(data + offset); offset += sizeof(u16); - header->frame_width = be16_to_cpu(*(__be16 *)(data + offset)); + header->frame_width = get_unaligned_be16(data + offset); offset += sizeof(u16); header->nb_of_components = *(u8 *)(data + offset); offset += sizeof(u8); -- 2.53.0