Re: [PATCH 1/1] cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

On Mon, 20 Jul 2026 20:44:21 +0100, Phillip Potter wrote:
> mmc_ioctl_cdrom_volume() first reads the audio control mode page into a
> 32-byte stack buffer with cgc->buflen set to 24.  If the device reports a
> block descriptor, the function increases cgc->buflen to include that
> descriptor and reads the page again.
> 
> For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list
> by moving cgc->buffer forward by offset - 8 bytes.  This drops the block
> descriptor from the outgoing payload and leaves a new 8-byte mode
> parameter header in front of the audio control page.  However, cgc->buflen
> is left unchanged.
> 
> [...]

Applied, thanks!

[1/1] cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
      commit: b27e195d4db8dea263050bdbeb11881b2999c9c6

Best regards,
-- 
Jens Axboe