Re: [PATCH RFC 02/38] PNP: isapnp: don't read past the end of the buffer on a large pread()

[Rafael J. Wysocki (Intel)]

On Mon, Nov 2, 2026 at 3:22 PM Christian Brauner <brauner@xxxxxxxxxx> wrote:
>
> isapnp_proc_bus_read() truncates the position to an int. A pread() at
> an offset like 0xfffffc00 turns it negative, the check against the size
> of the configuration space passes, and the loop then puts everything
> from that position up to byte 256 into the reader's buffer, no matter
> how few bytes were asked for.
>
> Keep the position as a loff_t and clamp the count against what is left
> of the configuration space.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>

Reviewed-by: Rafael J. Wysocki (Intel) <rafael@xxxxxxxxxx>

> ---
>  drivers/pnp/isapnp/proc.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/pnp/isapnp/proc.c b/drivers/pnp/isapnp/proc.c
> index c1f6e6bd0eb2..8197c7f29743 100644
> --- a/drivers/pnp/isapnp/proc.c
> +++ b/drivers/pnp/isapnp/proc.c
> @@ -23,14 +23,12 @@ static ssize_t isapnp_proc_bus_read(struct file *file, char __user * buf,
>                                     size_t nbytes, loff_t * ppos)
>  {
>         struct pnp_dev *dev = pde_data(file_inode(file));
> -       int pos = *ppos;
> +       loff_t pos = *ppos;
>         int cnt, size = 256;
>
>         if (pos >= size)
>                 return 0;
> -       if (nbytes >= size)
> -               nbytes = size;
> -       if (pos + nbytes > size)
> +       if (nbytes > size - pos)
>                 nbytes = size - pos;
>         cnt = nbytes;
>
>
> --
> 2.53.0
>
>