Re: [PATCH] media: sti: delta: use unaligned accessors for MJPEG SOF fields

[Nicolas Dufresne]

Hi,

Le mercredi 01 juillet 2026 à 23:06 +0800, Runyu Xiao a écrit :
> delta_mjpeg_read_header() scans a compressed MJPEG access unit byte by
> byte and passes the bytes after an SOF marker to delta_mjpeg_read_sof().
> The SOF parser then reads 16-bit big-endian fields directly from that
> byte stream.
> 
> The SOF payload is not an aligned object. The marker scan can find the
> payload at any byte position, and the SOF layout also puts frame_height
> and frame_width after a one-byte sample_precision field. Those fields
> therefore sit at odd offsets within the payload even when the payload
> base happens to be 2-byte aligned.
> 
> Avoid casting the byte stream to __be16 pointers and use
> get_unaligned_be16() for the SOF length, height, and width fields.
> 
> This issue was detected by our static analysis tool and confirmed by
> manual audit. A focused UBSAN alignment validation of the same typed
> load shape reported a misaligned __be16 access in delta_mjpeg_read_sof().
> 
> Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@xxxxxxxxxxxxx>

Picked, ty

> ---
>  drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
> index 90e5b2f72c82..849a5e118aec 100644
> --- a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
> +++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
> @@ -4,6 +4,7 @@
>   * Author: Hugues Fruchet <hugues.fruchet@xxxxxx> for STMicroelectronics.
>   */
>  
> +#include <linux/unaligned.h>
>  #include "delta.h"
>  #include "delta-mjpeg.h"
>  
> @@ -48,13 +49,13 @@ static int delta_mjpeg_read_sof(struct delta_ctx *pctx,
>  		goto err_no_more;
>  
>  	memset(header, 0, sizeof(*header));
> -	header->length           = be16_to_cpu(*(__be16 *)(data + offset));
> +	header->length           = get_unaligned_be16(data + offset);
>  	offset += sizeof(u16);
>  	header->sample_precision = *(u8 *)(data + offset);
>  	offset += sizeof(u8);
> -	header->frame_height     = be16_to_cpu(*(__be16 *)(data + offset));
> +	header->frame_height     = get_unaligned_be16(data + offset);
>  	offset += sizeof(u16);
> -	header->frame_width      = be16_to_cpu(*(__be16 *)(data + offset));
> +	header->frame_width      = get_unaligned_be16(data + offset);
>  	offset += sizeof(u16);
>  	header->nb_of_components = *(u8 *)(data + offset);
>  	offset += sizeof(u8);

Attachment: signature.asc
Description: This is a digitally signed message part