Messages in this thread | | | From | Steve Lee <> | Subject | RE: [PATCH] ASoC: max98390: Fix potential crash during param fw loading | Date | Wed, 3 Jun 2020 23:48:43 +0000 |
| |
> -----Original Message----- > From: Mark Brown <broonie@kernel.org> > Sent: Wednesday, June 3, 2020 8:43 PM > To: Steve Lee <SteveS.Lee@maximintegrated.com> > Cc: lgirdwood@gmail.com; perex@perex.cz; tiwai@suse.com; > ckeepax@opensource.cirrus.com; geert@linux-m68k.org; > rf@opensource.wolfsonmicro.com; shumingf@realtek.com; > srinivas.kandagatla@linaro.org; krzk@kernel.org; dmurphy@ti.com; > jack.yu@realtek.com; nuno.sa@analog.com; linux-kernel@vger.kernel.org; > alsa-devel@alsa-project.org; ryan.lee.maxim@gmail.com; Ryan Lee > <RyanS.Lee@maximintegrated.com>; steves.lee.maxim@gmail.com > Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw > loading > > On Wed, Jun 03, 2020 at 11:37:44AM +0000, Steve Lee wrote: > > > > This is now reading the size out of the header of the file which is > > > good but it should also validate that the file is big enough to have > > > this much data in it, otherwise it's possible to read beyond the end > > > of the firmware file (eg, if it got truncated somehow). Previously > > > the code used the size of the file read from disk so that wasn't an issue. > > > Thanks for quick comment. Can this case cover by below line? > > + if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) { > > + dev_err(component->dev, > > + "param fw is invalid.\n"); > > + goto err_alloc; > > + } > > No, that doesn't cover all of it - the case I'm concerned about is the case where > we've got enough data for the header but the payload is truncated. You need a > check that param_size + _PAYLOAD_OFFSET is less than fw->size as well.
Yes, I will update this and good enough.
| |