From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from fhigh-b8-smtp.messagingengine.com (fhigh-b8-smtp.messagingengine.com [202.12.124.159]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2FF9515E5BB for ; Mon, 27 Jul 2026 00:47:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.159 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785113229; cv=none; b=sGLDfsWGqphceP9/8lifxRPuT9smKh7cLkzsOKeXbbOaLPnzXYWDAwo1Gs9fB2FhOoyNkjdToUYwOCn1GjooMxRTRHXtFXp/RS55Ae+mnmpjeleTrq3DcmhNK6FZshNIzibZqKOkaORxNzlQgbyD1FNspU20qbQ6W3HH5d4smzs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785113229; c=relaxed/simple; bh=4yiBrICN0q2zWtxflJJDTueC7uXvAM7KvlarZmrgCCA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=hkwWUT8a5eYou1lbeNZjZcfCIEgFMVpFaE7fSBLE6B2oBlgI0PWXrNwBCPKbLYXftaWXSI2lwv2CKMiFTPNCxCRxMwSWm+iEMECiejPPAzJyQFxvRZu0oe9K/6TMsodX/eMVIkj2y9BnBufb2JYJU97CCCFs27dwcBHbTnLVqW4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sakamocchi.jp; spf=pass smtp.mailfrom=sakamocchi.jp; dkim=pass (2048-bit key) header.d=sakamocchi.jp header.i=@sakamocchi.jp header.b=FrA9ST+R; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=COyHaONd; arc=none smtp.client-ip=202.12.124.159 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sakamocchi.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sakamocchi.jp Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=sakamocchi.jp header.i=@sakamocchi.jp header.b="FrA9ST+R"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="COyHaONd" Received: from phl-compute-05.internal (phl-compute-05.internal [10.202.2.45]) by mailfhigh.stl.internal (Postfix) with ESMTP id 4F24A7A00BA; Sun, 26 Jul 2026 20:47:06 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-05.internal (MEProxy); Sun, 26 Jul 2026 20:47:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakamocchi.jp; h=cc:cc:content-type:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1785113226; x= 1785199626; bh=w/1h4/k4kgPapywbXbjHAZJEteyqxLDoCC7lzpXhpV8=; b=F rA9ST+Rt/zjEGbbEXYcKDZgaSQKzh0+i1AvBltxidGklTlA5BUJNYLd6lwuQCCVT ayTncvdLo4wNFuIPZ/JI8ovQT5enIRwnQsaPy52aClarbuKk/N/9V8tRDkHEsR0R /jn6MHVZMDfWi7wPM/edU7edLCjtwTxNdSVM2G+gcaCgvTgK8mG+ri2QKIHqbx9k 1J3GNIyIxk1dZBiHwfbA9GsWL5QeJrlCuAVXDQdTKukooWKos5OkLIH49+Lqifrl 0HGA+OgiD8BddA9A+wYqt4BHsQTuK39y/X4J68Zkw6CmV6lkwhJ6VkWd2ITfxWqV 7wpa31RPmX+IZyTn5xe1w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t= 1785113226; x=1785199626; bh=w/1h4/k4kgPapywbXbjHAZJEteyqxLDoCC7 lzpXhpV8=; b=COyHaONd6Cjtp7Q7KxzxgeiLkZmQszfW8jFLi+34uD1dRw1yijK 7UPExCW06az60A96HRoAB3gJe7s7PXe97J/qUg4t01nhBeCWWcinHw51hLEEDtCq 3QsNpXzKoJGHljBxAyX6LjfeUid4uARIHkPz+N8ESJ2BI7DOxi4Rv6+KaV3kLq5m Fhh+DZtMkZSzOprByaoOx+rbD4mPI3oSaTiSbOqqTUpco16esPvXMMb5sriXuY4p OuM2P1mmzI/9cc/qIpAclh3ZoURUk00yv0GfwJG9Oqv/WSUsEqD8j2/mmm8959Uw dxD8UEK7sOe+UlOzY4/zp4IdHjSnrTPAqog== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGv/gsQxtk1ffOnFhrukC2hJW0kzLNJEZTrW26LmWBXHCcNihw8eCKNloItZKlBPe 7Sh5T/kpw/vCrKOEm8LBGqOSwWzn3SdbL85RIMKubZrukPl2syjkYxdj/z83e3ketvKxXg megs9WoiW7UFIEDZZWvCOlE6OJ2CkgzBxlPT7Kpa2sCENhPJaE/9s6/2wxlzXus3eTMYbq i78dA7oX8JJwP5Jg84DXtKnUQiXublVwfr7S+y3HE7XhxEDN3LN+3DH9PEDxJ+II8PBJFt 5Gi2S2YJd7AcLRlPwYqyQYa7Yy5PYOMTU/EVS826d4AiOOhnK78voaD94G8UoDeFIsmpec 1ymGMsZcFVtD3QWwq3kQDktFF63ovsIsO9Zs9ZXOf5NFHkrBVvBuc656W5Sjzyitl214SX F442xKh6N244auFqJn1uB/gZXV1aXsyzpYWfbOorcITue72LdE85y+5fI1wSMrFjBWh9Rs grwxXUTk21l7TE0EQX/GWNDHz1OI7RjeK4Zh8ZE3FJIRXc2vOyVtGKftDWk+Rbq2TqRHAX WoDj7449Pmxj/JVCODPvc0pLodnAcPAlUX2DiIQodDemei9RGaGS9ZcqZBN6vvQQnE2SLM XoCsxbFiTwbno2NAuaxWuex8eJuoDsn9Ozypqvk/ps+y/SFnLGX8xGLQK5eg X-ME-Proxy: Feedback-ID: ie8e14432:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 26 Jul 2026 20:47:05 -0400 (EDT) Date: Mon, 27 Jul 2026 09:47:02 +0900 From: Takashi Sakamoto To: Sreeraj S Kurup Cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3 0/2] firewire: core: validate descriptor and sub-block lengths in fw_core_add_descriptor() Message-ID: <20260727004702.GA237697@sakamocchi.jp> Mail-Followup-To: Sreeraj S Kurup , linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org References: <20260725155255.3054-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260725155255.3054-1-sreekuttan2156239@gmail.com> Hi, On Sat, Jul 25, 2026 at 03:52:53PM +0000, Sreeraj S Kurup wrote: > This two-patch series addresses potential out-of-bounds memory > accesses when parsing Config ROM descriptors in > fw_core_add_descriptor(). > > Patch 1 adds overall length validation using the in_range() macro > to ensure descriptors fit within standard IEEE 1394 Config ROM > limits (256 quadlets). > > Patch 2 validates individual sub-block header lengths during > iteration to prevent reading past allocated buffer boundaries on > malformed inputs. > > v2 -> v3: > - Split original single patch into two distinct commits for cleaner > review as requested by Takashi Sakamoto. > - Simplified overall length check using the in_range() macro. > > Sreeraj S Kurup (2): > firewire: core: validate overall descriptor length in > fw_core_add_descriptor() > firewire: core: validate sub-block lengths in fw_core_add_descriptor() > > drivers/firewire/core-card.c | 28 ++++++++++++++++++++++------ > 1 file changed, 22 insertions(+), 6 deletions(-) Applied to for-next branch. By the way, how do you think about the following change in your previous patches? It seems to be omitted from current patchset. ======== 8< -------- diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c index a754c6366b97..cb8ce491fe9d 100644 --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -143,7 +143,11 @@ static void generate_config_rom(struct fw_card *card, __be32 *config_rom) for (i = 0; i < j; i += length + 1) length = fw_compute_block_crc(config_rom + i); - WARN_ON(j != config_rom_length); + if (j != config_rom_length) { + pr_warn("FireWire ROM length mismatch: expected %zu, got %d\n", + config_rom_length, j); + config_rom_length = j; + } } ======== 8< -------- Thanks Takashi Sakamoto