lkml.org 
[lkml]   [2020]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] ASoC: max98390: Fix potential crash during param fw loading
Date
> -----Original Message-----
> From: Mark Brown <broonie@kernel.org>
> Sent: Wednesday, June 3, 2020 8:43 PM
> To: Steve Lee <SteveS.Lee@maximintegrated.com>
> Cc: lgirdwood@gmail.com; perex@perex.cz; tiwai@suse.com;
> ckeepax@opensource.cirrus.com; geert@linux-m68k.org;
> rf@opensource.wolfsonmicro.com; shumingf@realtek.com;
> srinivas.kandagatla@linaro.org; krzk@kernel.org; dmurphy@ti.com;
> jack.yu@realtek.com; nuno.sa@analog.com; linux-kernel@vger.kernel.org;
> alsa-devel@alsa-project.org; ryan.lee.maxim@gmail.com; Ryan Lee
> <RyanS.Lee@maximintegrated.com>; steves.lee.maxim@gmail.com
> Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw
> loading
>
> On Wed, Jun 03, 2020 at 11:37:44AM +0000, Steve Lee wrote:
>
> > > This is now reading the size out of the header of the file which is
> > > good but it should also validate that the file is big enough to have
> > > this much data in it, otherwise it's possible to read beyond the end
> > > of the firmware file (eg, if it got truncated somehow). Previously
> > > the code used the size of the file read from disk so that wasn't an issue.
>
> > Thanks for quick comment. Can this case cover by below line?
> > + if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
> > + dev_err(component->dev,
> > + "param fw is invalid.\n");
> > + goto err_alloc;
> > + }
>
> No, that doesn't cover all of it - the case I'm concerned about is the case where
> we've got enough data for the header but the payload is truncated. You need a
> check that param_size + _PAYLOAD_OFFSET is less than fw->size as well.

Yes, I will update this and good enough.

\
 
 \ /
  Last update: 2020-06-04 01:49    [W:0.052 / U:0.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site