[PATCH v3] iio: proximity: hx9023s: validate firmware size

[PATCH v3] iio: proximity: hx9023s: validate firmware size

[Laxman Acharya Padhya]

hx9023s_send_cfg() copies the firmware into a counted flexible array and
then reads fixed offsets from the copied data before walking register/value
pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore
make the driver read past the copied buffer during probe-time configuration
loading.

Reject firmware images that cannot contain the fixed header, reject images
too large for the u16 fw_size field, and validate that the advertised
register count fits in the remaining payload.

Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file
parsing functionality")
Cc: stable@vger.kernel.org
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
v3:
- Resend once in plain-text format after the duplicate v2 messages.
- Keep each commit trailer on one complete line.
---
 drivers/iio/proximity/hx9023s.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c
index a6ff7cbe9e65..685053b84b34 100644
--- a/drivers/iio/proximity/hx9023s.c
+++ b/drivers/iio/proximity/hx9023s.c
@@ -18,6 +18,7 @@
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
 #include <linux/irqreturn.h>
+#include <linux/limits.h>
 #include <linux/math64.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
@@ -1031,6 +1032,10 @@ static int hx9023s_bin_load(struct hx9023s_data
*data, struct hx9023s_bin *bin)

 static int hx9023s_send_cfg(const struct firmware *fw, struct
hx9023s_data *data)
 {
+ /* fw_size is u16 in struct hx9023s_bin, so reject truncation. */
+ if (fw->size < FW_DATA_OFFSET || fw->size > U16_MAX)
+ return -EINVAL;
+
  struct hx9023s_bin *bin __free(kfree) =
   kzalloc(fw->size + sizeof(*bin), GFP_KERNEL);
  if (!bin)
@@ -1041,7 +1046,8 @@ static int hx9023s_send_cfg(const struct
firmware *fw, struct hx9023s_data *data
  bin->fw_ver = bin->data[FW_VER_OFFSET];
  bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET);

- release_firmware(fw);
+ if (bin->reg_count > (bin->fw_size - FW_DATA_OFFSET) / 2)
+ return -EINVAL;

  return hx9023s_bin_load(data, bin);
 }
@@ -1058,6 +1064,7 @@ static void hx9023s_cfg_update(const struct
firmware *fw, void *context)
  }

  ret = hx9023s_send_cfg(fw, data);
+ release_firmware(fw);
  if (ret) {
   dev_warn(dev, "Firmware update failed: %d\n", ret);
   goto no_fw;
-- 
2.51.2

Re: [PATCH v3] iio: proximity: hx9023s: validate firmware size

[Andy Shevchenko]

On Mon, Jul 13, 2026 at 10:31:30AM +0545, Laxman Acharya Padhya wrote:
> hx9023s_send_cfg() copies the firmware into a counted flexible array and
> then reads fixed offsets from the copied data before walking register/value
> pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore
> make the driver read past the copied buffer during probe-time configuration
> loading.
> 
> Reject firmware images that cannot contain the fixed header, reject images
> too large for the u16 fw_size field, and validate that the advertised
> register count fits in the remaining payload.

> Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file
> parsing functionality")

This has to be a single line.

> Cc: stable@vger.kernel.org
> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>

...

> v3:
> - Resend once in plain-text format after the duplicate v2 messages.
> - Keep each commit trailer on one complete line.

None of these is being addressed.

...

>  static int hx9023s_send_cfg(const struct firmware *fw, struct
> hx9023s_data *data)
>  {
> + /* fw_size is u16 in struct hx9023s_bin, so reject truncation. */
> + if (fw->size < FW_DATA_OFFSET || fw->size > U16_MAX)
> + return -EINVAL;

The patch is mangled. Please, conduct an investigation before sending any new
versions or other patches to the kernel mailing lists.

>   struct hx9023s_bin *bin __free(kfree) =
>    kzalloc(fw->size + sizeof(*bin), GFP_KERNEL);
>   if (!bin)

Compare the above to

	struct hx9023s_bin *bin __free(kfree) =
		kzalloc(fw->size + sizeof(*bin), GFP_KERNEL);
	if (!bin)
		return -ENOMEM;

	bin->fw_size = fw->size;
	memcpy(bin->data, fw->data, bin->fw_size);

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v3] iio: proximity: hx9023s: validate firmware size

[Joshua Crofts]

On Mon, 13 Jul 2026 14:34:32 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Mon, Jul 13, 2026 at 10:31:30AM +0545, Laxman Acharya Padhya wrote:
> > hx9023s_send_cfg() copies the firmware into a counted flexible array and
> > then reads fixed offsets from the copied data before walking register/value
> > pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore
> > make the driver read past the copied buffer during probe-time configuration
> > loading.
> > 
> > Reject firmware images that cannot contain the fixed header, reject images
> > too large for the u16 fw_size field, and validate that the advertised
> > register count fits in the remaining payload.  
> 
> > Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file
> > parsing functionality")  
> 
> This has to be a single line.
> 
> > Cc: stable@vger.kernel.org
> > Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

Remove my tag for the time being, I do agree with the change in principle
however this patch needs a bit more work than I expected. Happy to re-review
once everyone's comments have been addressed.

-- 
Kind regards

CJD