On Mon, Nov 2, 2026 at 3:22 PM Christian Brauner <[email protected]> wrote: > > isapnp_proc_bus_read() truncates the position to an int. A pread() at > an offset like 0xfffffc00 turns it negative, the check against the size > of the configuration space passes, and the loop then puts everything > from that position up to byte 256 into the reader's buffer, no matter > how few bytes were asked for. > > Keep the position as a loff_t and clamp the count against what is left > of the configuration space. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Cc: [email protected] > Signed-off-by: Christian Brauner (Amutable) <[email protected]>
Reviewed-by: Rafael J. Wysocki (Intel) <[email protected]> > --- > drivers/pnp/isapnp/proc.c | 6 ++---- > 1 file changed, 2 insertions(+), 4 deletions(-) > > diff --git a/drivers/pnp/isapnp/proc.c b/drivers/pnp/isapnp/proc.c > index c1f6e6bd0eb2..8197c7f29743 100644 > --- a/drivers/pnp/isapnp/proc.c > +++ b/drivers/pnp/isapnp/proc.c > @@ -23,14 +23,12 @@ static ssize_t isapnp_proc_bus_read(struct file *file, > char __user * buf, > size_t nbytes, loff_t * ppos) > { > struct pnp_dev *dev = pde_data(file_inode(file)); > - int pos = *ppos; > + loff_t pos = *ppos; > int cnt, size = 256; > > if (pos >= size) > return 0; > - if (nbytes >= size) > - nbytes = size; > - if (pos + nbytes > size) > + if (nbytes > size - pos) > nbytes = size - pos; > cnt = nbytes; > > > -- > 2.53.0 > >
