[PATCH] media: dvb-frontends: ds3000: validate firmware size

[PATCH] media: dvb-frontends: ds3000: validate firmware size

[Pengpeng Hou]

The firmware diagnostic reads the first two and final two bytes without
proving that the firmware object contains at least two bytes.

Reject undersized firmware before the diagnostic and upload path consume
it.

Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/media/dvb-frontends/ds3000.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index ce7ae424b27cc..76d2eb98932ae 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -374,6 +374,8 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
 	int ret = 0;
 
 	dprintk("%s\n", __func__);
+	if (fw->size < 2)
+		return -EINVAL;
 	dprintk("Firmware is %zu bytes (%02x %02x .. %02x %02x)\n",
 			fw->size,
 			fw->data[0],

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1

Re: [PATCH] media: dvb-frontends: ds3000: validate firmware size

[Jonathan Corbet]

Pengpeng Hou <pengpeng@iscas.ac.cn> writes:

> The firmware diagnostic reads the first two and final two bytes without
> proving that the firmware object contains at least two bytes.
>
> Reject undersized firmware before the diagnostic and upload path consume
> it.
>
> Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/media/dvb-frontends/ds3000.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
> index ce7ae424b27cc..76d2eb98932ae 100644
> --- a/drivers/media/dvb-frontends/ds3000.c
> +++ b/drivers/media/dvb-frontends/ds3000.c
> @@ -374,6 +374,8 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
>  	int ret = 0;
>  
>  	dprintk("%s\n", __func__);
> +	if (fw->size < 2)
> +		return -EINVAL;

So, you have generated an awful lot of fixes all over the tree in the
last few months.  Can you tell us about what tool you are using to find
and fix these bugs, and how you are testing your fixes?

Thanks,

jon

Re: Re: [PATCH] media: dvb-frontends: ds3000: validate firmware size

[侯朋朋]

We are a systems software research group developing static analysis tools similar to Sparse and Coccinelle. Our goal is to publish at venues such as FSE and ICSE while also contributing useful fixes upstream.
Most of our kernel patches originate from findings reported by our tools and are reviewed both manually and with LLM assistance. Dynamic validation is often impractical, especially for hardware-dependent driver code, and emulation is not always sufficient. We therefore rely mainly on static analysis and careful review, and often state this way in our prior patches:The issue was identified through static analysis and manually reviewed.


> -----原始邮件-----
> 发件人: "Jonathan Corbet" <corbet@lwn.net>
> 发送时间: 2026-08-30 22:45:40 (星期日)
> 收件人: "Pengpeng Hou" <pengpeng@iscas.ac.cn>, "Mauro Carvalho Chehab" <mchehab@kernel.org>
> 抄送: "Pengpeng Hou" <pengpeng@iscas.ac.cn>, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
> 主题: Re: [PATCH] media: dvb-frontends: ds3000: validate firmware size
> 
> Pengpeng Hou <pengpeng@iscas.ac.cn> writes:
> 
> > The firmware diagnostic reads the first two and final two bytes without
> > proving that the firmware object contains at least two bytes.
> >
> > Reject undersized firmware before the diagnostic and upload path consume
> > it.
> >
> > Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
> > Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> > ---
> >  drivers/media/dvb-frontends/ds3000.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
> > index ce7ae424b27cc..76d2eb98932ae 100644
> > --- a/drivers/media/dvb-frontends/ds3000.c
> > +++ b/drivers/media/dvb-frontends/ds3000.c
> > @@ -374,6 +374,8 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
> >  	int ret = 0;
> >  
> >  	dprintk("%s\n", __func__);
> > +	if (fw->size < 2)
> > +		return -EINVAL;
> 
> So, you have generated an awful lot of fixes all over the tree in the
> last few months.  Can you tell us about what tool you are using to find
> and fix these bugs, and how you are testing your fixes?
> 
> Thanks,
> 
> jon

Re: Re: [PATCH] media: dvb-frontends: ds3000: validate firmware size

[Jonathan Corbet]

侯朋朋 <pengpeng@iscas.ac.cn> writes:

> We are a systems software research group developing static analysis
> tools similar to Sparse and Coccinelle. Our goal is to publish at
> venues such as FSE and ICSE while also contributing useful fixes
> upstream.  Most of our kernel patches originate from findings reported
> by our tools and are reviewed both manually and with LLM
> assistance. Dynamic validation is often impractical, especially for
> hardware-dependent driver code, and emulation is not always
> sufficient. We therefore rely mainly on static analysis and careful
> review, and often state this way in our prior patches:The issue was
> identified through static analysis and manually reviewed.

Which is all good and fine, and the fixes are appreciated, but you need
to be citing the tools in your changelogs.  Please see

	Documentation/process/researcher-guidelines.rst

and

        Documentation/process/coding-assistants.rst

Thanks,

jon