[PATCH] staging: vme_user: handle zero image size in read/write

[PATCH] staging: vme_user: handle zero image size in read/write

[LiuJunyuan]

vme_get_size() can return zero for an unallocated image. The existing
image_size - 1 checks underflow in that case and can allow an invalid
position to proceed, wrapping the subsequent count calculation. Check
image_size and *ppos directly instead.

Signed-off-by: LiuJunyuan <2058432396@qq.com>
---
 drivers/staging/vme_user/vme_user.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vme_user/vme_user.c b/drivers/staging/vme_user/vme_user.c
index a472a38ef613..58566c01003a 100644
--- a/drivers/staging/vme_user/vme_user.c
+++ b/drivers/staging/vme_user/vme_user.c
@@ -213,7 +213,7 @@ static ssize_t vme_user_read(struct file *file, char __user *buf, size_t count,
 	image_size = vme_get_size(image[minor].resource);
 
 	/* Ensure we are starting at a valid location */
-	if ((*ppos < 0) || (*ppos > (image_size - 1))) {
+	if (*ppos < 0 || image_size == 0 || *ppos >= image_size) {
 		mutex_unlock(&image[minor].mutex);
 		return 0;
 	}
@@ -255,7 +255,7 @@ static ssize_t vme_user_write(struct file *file, const char __user *buf,
 	image_size = vme_get_size(image[minor].resource);
 
 	/* Ensure we are starting at a valid location */
-	if ((*ppos < 0) || (*ppos > (image_size - 1))) {
+	if (*ppos < 0 || image_size == 0 || *ppos >= image_size) {
 		mutex_unlock(&image[minor].mutex);
 		return 0;
 	}
-- 
2.43.0

Re: [PATCH] staging: vme_user: handle zero image size in read/write

[Dan Carpenter]

On Wed, Oct 21, 2026 at 11:41:38AM +0800, LiuJunyuan wrote:
> vme_get_size() can return zero for an unallocated image. The existing
> image_size - 1 checks underflow in that case and can allow an invalid
> position to proceed, wrapping the subsequent count calculation. Check
> image_size and *ppos directly instead.
> 
> Signed-off-by: LiuJunyuan <2058432396@qq.com>
> ---

This one is a bug fix and needs a Fixes tag.

regards,
dan carpenter

Re: [PATCH] staging: vme_user: handle zero image size in read/write

[Dan Carpenter]

We removed the requirement that AI patches need to a special tag.

Generally, staging is just for practice writing code so it doesn't
make sense to use AI, but I was asking Greg to merge AI security fixes
like this so we'll see how persuasive I was.  :)  The vme_user code is
full of way more serious security issues and probably we should just
delete it.

regards,
dan carpenter

Re: [PATCH] staging: vme_user: handle zero image size in read/write

[Greg KH]

On Wed, Oct 21, 2026 at 09:04:18AM +0300, Dan Carpenter wrote:
> We removed the requirement that AI patches need to a special tag.
> 
> Generally, staging is just for practice writing code so it doesn't
> make sense to use AI, but I was asking Greg to merge AI security fixes
> like this so we'll see how persuasive I was.  :)  The vme_user code is
> full of way more serious security issues and probably we should just
> delete it.

I agree, we should just delete it at this point in time.  I'll gladly
take a patch for that.

thanks,

greg k-h