From nobody Thu Apr 9 23:25:14 2026 Received: from mail-ej1-f48.google.com (mail-ej1-f48.google.com [209.85.218.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 347AF1DF970 for ; Thu, 5 Mar 2026 01:57:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772675831; cv=none; b=gvGKlNCTa3KwyQ/IJSFwPriGOezWu8ela+67cMSUydv8FHYndVHUf62RNoI5ED4DqSxLN7d+znxZiuNjcrm4PnlWVlQ/0Np5orGlOOSCs29QS65u8DB9iQ0dOooTWqRD5x+ceHRRmADROePqQzpfLdwZgbL5kYMeiE+hM3SinO4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772675831; c=relaxed/simple; bh=m3rreqZq6vLT3EhYaY86P9t15/dsh1CgCsl/SObRA/A=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gaUD5p5I82XwdNVvTS+sofP8eCG0e0jmCf+hL2bhTGjpq3cIFu2OyBBRvFnq/bORd919XsUoCzvdu/4v0y6NLJ5CyyrtoUR/VCnuKkLuy1ILAhq/xqqXc1PA0uWl5DiYxmewlCBpFoI2Wp6EIDHiv0Ul7tjax75PvVkecMJm7k0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eVUQDXZ2; arc=none smtp.client-ip=209.85.218.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eVUQDXZ2" Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-b9361c771e9so1209048466b.3 for ; Wed, 04 Mar 2026 17:57:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772675826; x=1773280626; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=kK5AArLisBowhIk8Yemj1T34WbKtX8pFHOmbdJsZGWg=; b=eVUQDXZ22lwJAhahcpW31JxAQ2DCMHCHBsWxZfqmKM+KPMqOj3wTg22vjyK1SSNS4+ mhrQegg57vEfoAMPo6v7M4GwzpnLA7twXHEdmOuqn9rjezDAfMJYz2wDD5NW97GweOYE 8pRNTXFki3wCSYgrjARWuMMsA1uHpm5dl5sIkT10ahDBZywy94csCq7D+Mo3M8qvlypA TPaDunQTzb4tTtGaXdBNnAeoyyKF+gcYXtSC/+zUf1Q8WDJOpAA1S38i+D0jcAjOIBUr 2nXRkLfI84Kmd0PUoMibq/k6MgTQnonUUs1KvSYsCyQEOkXFj/blkbLrnOEvptNEfEyS z+oA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772675826; x=1773280626; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=kK5AArLisBowhIk8Yemj1T34WbKtX8pFHOmbdJsZGWg=; b=Q+TuTdIIRpmLsBDJUoydl4VQrYixSQyTn4rjk19yG0DI2e8WB95dK04ENdVfaOyqHG Aki9pMa8CsxWiIWbLnBHqbEbf41+g/A6RoIHZurJGZ+JLsT94WXyh3ncict1K8W3nHjr p/BOO16735xBV/sG+M4+C+OUetfxFMxT7OQmBIE6L71PNoFfjd20RiFU4J6u8PjVYn2d nJyLlzZSdlcZqv3irbueSBn88z0V65hzlB3tVLqhaAJ6y4rSNIdpWdtjVqN6iSDwjt6v sKLaAMTarNj1HDXDiVMBE4jHmhWZ5Gml7KkzOTwku/B4bShEx2RxxC1m/5tB/qN2uuat B+Xw== X-Forwarded-Encrypted: i=1; AJvYcCULFnr+bhqv4QBcP2hlLZh6Oa04dGgEwLvYoda71AadnT3nSlXEiMCXOxuhPca2ieMJLpPYgB51iroIyIk=@vger.kernel.org X-Gm-Message-State: AOJu0Yw2H2vHmN06lVb048Cc99HChPjizIpklysyvNuM1S6foanRsbRi qQD1p4w9Dqg5KufUq2+Hx5lQnCAZdxBkvS7Gu/87BpilfuMMgsZqHDOG X-Gm-Gg: ATEYQzzlRlqK2dZXuLIXLkuEabrdaFf3HAS1lnS3TZGRYjWdNSmdTKnhOgsv3aASWf1 QiNTI5QRcnrVSIVmobuqhOR0CEVUc96m2RZiLIUthVkeSmYgV91mPqIQz25F3ktFBLVrq+I5Sy1 ond3BEetkL829P//Dos53j7206n25GUkmq6CBVfdKYZs40yYW9RgSgjT6rzupNC7jMLxxeowbYH N6DMdFN9N/Qo+2molJjB155EmExecWcqHfAhUkBs+6LN7CmcGVkPrMlPbt3VOm6rCP0fzzuMJxV szdTB0dHqO1BaOFfPJXzgHp8la9Dcu9aCKDLqdeIKtGeRQm7GbodbFeCwMpqnuHWlA0laFEjYnT wX9J6ICmaVIh+xXV8TqkTpeIeL38Ta+ylm78ftdotnkvlObvvA6YMC0sXggnlvX+5U59Ndyti4k Alr08bQZfniuEEElUCiQc1tj9EZTnwwo3EaN2fZ1sSjOrXszVHrRoRSMSQ+6+gfAJWq3Pm6Gn5e s6IipJLcnFCAZ40+RZEsDgE3Yt39CKVXyIuHC3UhxfByb7xRnb1R/ILxwzHa3FiS471UGz6nC+q SX+kmL9xa49NrGF/s4KqlSZNE9Q= X-Received: by 2002:a17:907:3f8e:b0:b93:8e7f:3d3f with SMTP id a640c23a62f3a-b93f1434126mr261836966b.32.1772675826290; Wed, 04 Mar 2026 17:57:06 -0800 (PST) Received: from DESKTOP-JNMGKT5.residents.sin.openfiber.nl ([88.202.160.248]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b93eea5869bsm174820966b.13.2026.03.04.17.57.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Mar 2026 17:57:05 -0800 (PST) From: Alexandru Hossu To: parthiban.veerasooran@microchip.com Cc: christian.gromm@microchip.com, gregkh@linuxfoundation.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Alexandru Hossu Subject: [PATCH] staging: most: video: fix read() length underflow Date: Thu, 5 Mar 2026 02:57:03 +0100 Message-ID: <20260305015703.41762-1-hossu.alexandru@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Avoid unsigned underflow when fh->offs exceeds mbo->processed_length. Use size_t for length calculations and clamp invalid offsets. Signed-off-by: Alexandru Hossu --- drivers/staging/most/video/video.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/vide= o/video.c index 04351f8ccccf..8c4800be875e 100644 --- a/drivers/staging/most/video/video.c +++ b/drivers/staging/most/video/video.c @@ -158,7 +158,7 @@ static ssize_t comp_vdev_read(struct file *filp, char _= _user *buf, { struct comp_fh *fh =3D to_comp_fh(filp); struct most_video_dev *mdev =3D fh->mdev; - int ret =3D 0; + ssize_t ret =3D 0; =20 if (*pos) return -ESPIPE; @@ -177,8 +177,19 @@ static ssize_t comp_vdev_read(struct file *filp, char = __user *buf, =20 while (count > 0 && data_ready(mdev)) { struct mbo *const mbo =3D get_top_mbo(mdev); - int const rem =3D mbo->processed_length - fh->offs; - int const cnt =3D rem < count ? rem : count; + size_t rem, cnt; + + if (fh->offs >=3D mbo->processed_length) { + fh->offs =3D 0; + spin_lock_irq(&mdev->list_lock); + list_del(&mbo->list); + spin_unlock_irq(&mdev->list_lock); + most_put_mbo(mbo); + continue; + } + + rem =3D mbo->processed_length - fh->offs; + cnt =3D min_t(size_t, rem, count); =20 if (copy_to_user(buf, mbo->virt_address + fh->offs, cnt)) { v4l2_err(&mdev->v4l2_dev, "read: copy_to_user failed\n"); --=20 2.43.0