From nobody Sun Feb 8 15:59:22 2026 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCA7A325716 for ; Thu, 8 Jan 2026 20:03:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767902617; cv=none; b=d9FSjuNTDht4b77PMePCVP/ENLSsfHDIrdKi9s9ytwGOE2g4J0WcnujOLty5rq2Hk1sJO5yQC6dyj947Ze/xNCCtq4+rtP93iBafBYUYxobfhPa+RKmQwbk0zVvD9aZ6KSv/heC65TrjZwsDToUAw+e3h+GsYlGkMdawVo65aKo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767902617; c=relaxed/simple; bh=xW14wuO3rpDunHqMU7wmi3C0CV34THPunsb7vXrsYYk=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=g7JXP2rY3x1K3hjQSrgYirWqPEwdHZxO6K7egWPVwRhvyuFBaGBtoONytvA/PYEjDNvPJ1CsAyS5vz9w+HuRMrzfzpCvKuiCwRlMMGtamdesSoHEPvmb/E3uvQYryVvqzVSWrnmwjXXAAMF32eE2dwflhYpvQg77Z3XaxQpXfDA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=A5qyu6IH; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="A5qyu6IH" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-47795f6f5c0so22425265e9.1 for ; Thu, 08 Jan 2026 12:03:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1767902614; x=1768507414; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=U+0IrpcN+V0oqtValorBiZ1wiITEvHQIGq+jybV+6PM=; b=A5qyu6IHAjh3j5QjY1VhAY3yO1sfc1KUyNuIKKeBkeOsWVx7zoO9GKB+fDcQvNGIXE BWs/OtZJ6mdXNGkU1vzDawn74EgHQpn1APPyexKB/EMT2vFqHhF3KHj6ZtZ0l9PXn0LP j/CKjD0QFvnljZZopQiPmIkCDjQLxCyNHdO0LTejCS02g5DE9d9+xVSSR84kabENFK9n sADsdummxNvO+JEhIQVgHTOrHGWI0TAlmIcNzsyrIytCHGRlhTxMAeq1+ftyW5l6Ei06 vClD1nDo0Yh0UK7kpQ1c6YqXZxGpilcvCr64Dp4Osk8dlbgJM9dO7vGJ3lB9euan+Jym sgXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767902614; x=1768507414; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=U+0IrpcN+V0oqtValorBiZ1wiITEvHQIGq+jybV+6PM=; b=sBTuxvUzx+eCuyq+PP9BBShjFFn1WuGEfdcvcmq34WT8UcDJGQ5Yzari5+i04WgMLT 2m9VYN0OA6UvXGcF9rUKcPu18NQPeKJgTdHqOzH6dJlzVNErKTo62uw/RoPna3cN1Qaz mlldEzL/uH6wRjJLhS7cwlTt9WcBuM6n3d2hrpSDgCzbB3pI/oFmsYIExnTZBwSyjMiB ofrJpzWuKlutOz2DpyJ9Gq2vzye1GUt2Kx4o1kGaWhsi0JLHq89VE6mTQfJXfKLUYecq EXAunaouKcYl5aoMdkDslVGtD+pWzMaK5TLb2z5Ur9I6PfqMkVbPGIOxdEeBPignD+1o j37A== X-Forwarded-Encrypted: i=1; AJvYcCUg/fTglRv+Jt411EBI50ICg/8pN+nEjtof78ImsYpWsZSk+cv1U+qs6aYj/uYCUAhxgQ0oY6dUSRhyHzk=@vger.kernel.org X-Gm-Message-State: AOJu0Yw5HKKhfF2O+1jyomoNoISDIwKWx2CYPry7fBf/wtF0xkcz+uxe 0CfBi8QmBAp+0J7EVa8+ABSnf5EeJUaKG4KYNwAFk2BPtGvYD1OPDL5miy/mRigNRTI= X-Gm-Gg: AY/fxX5H0Au85MsmZ+3Vl+OOmYyrjtQOYVoK3Gnb3/1cJKTKEFd8n/1j7LHFO1Gn0f+ slrb1L0kS9iRrjTprvpGdjI72CA3QOITHwz5Tcg0xEToM03OZ7s4ce7cmPUsyiYVDigRC8hbBkG fewxzAI8v1adI8mXEbtoM6tpG3hxORAu8s4AC4zssc0RpkMt33DZO1sfdMj/CUXJWJ9QQrEft5w DAxgz6gxksorI+uBNNCFjJKyoyLoY0O+MagDDf3kw80ZAujvtZWMu+sskI1tjnu4FtvFU5m2aGt T8DVoam4LaEQBJSi7HzWaJC/ce6GtX4JIySLT7PMWpcm1zPS7fN6o2FYORFEELXcMXfstQMn8NO m/t5Kerda0BWm8L+ejbuP4KN1XE7YnuZwso+BSb9AzxPjci0/VW8NKK4xkH1aNzx1Ia4cscICn2 DC95fV+f83kqwGq4+S X-Google-Smtp-Source: AGHT+IF09Jx1RsKf/ckE/pQqCWP+iFQloONpAQuOq6DavbULp1WEe4q21ANMIGV5Sd+vyzTCa2FeOg== X-Received: by 2002:a05:600c:450f:b0:479:3a89:121e with SMTP id 5b1f17b1804b1-47d84b614c6mr85847175e9.37.1767902614177; Thu, 08 Jan 2026 12:03:34 -0800 (PST) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-47d7f65d9f0sm177083095e9.12.2026.01.08.12.03.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Jan 2026 12:03:33 -0800 (PST) Date: Thu, 8 Jan 2026 23:03:31 +0300 From: Dan Carpenter To: Shreeya Patel Cc: Dmitry Osipenko , Mauro Carvalho Chehab , Dingxian Wen , Hans Verkuil , linux-media@vger.kernel.org, kernel@collabora.com, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] media: synopsys: hdmirx: fix integer overflow in hdmirx_get_edid() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The "edid->blocks" variable comes from the user via the ioctl. It's a u32 and "edid->start_block" is a u32 too. The addition operation could have an integer wrapping bug, so use the size_add() function to prevent that. Cc: stable@vger.kernel.org Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input= driver") Signed-off-by: Dan Carpenter Acked-by: Dmitry Osipenko --- drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers= /media/platform/synopsys/hdmirx/snps_hdmirx.c index c3007e09bc9f..f054e30cbfb0 100644 --- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c +++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c @@ -717,7 +717,7 @@ static int hdmirx_get_edid(struct file *file, void *fh,= struct v4l2_edid *edid) if (edid->start_block >=3D hdmirx_dev->edid_blocks_written || !edid->bloc= ks) return -EINVAL; =20 - if (edid->start_block + edid->blocks > hdmirx_dev->edid_blocks_written) + if (size_add(edid->start_block, edid->blocks) > hdmirx_dev->edid_blocks_w= ritten) edid->blocks =3D hdmirx_dev->edid_blocks_written - edid->start_block; =20 memcpy(edid->edid, hdmirx_dev->edid, edid->blocks * EDID_BLOCK_SIZE); --=20 2.51.0