From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Maoyi Xie <maoyixie.tju@gmail.com>
Cc: Vaibhav Agarwal <vaibhav.sr@gmail.com>,
Mark Greer <mgreer@animalcreek.com>,
Johan Hovold <johan@kernel.org>, Alex Elder <elder@kernel.org>,
greybus-dev@lists.linaro.org, linux-staging@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: Re: staging: greybus: audio: possible out of bounds read in the topology parser
Date: Fri, 19 Jun 2026 06:37:35 +0200 [thread overview]
Message-ID: <2026061910-supply-jersey-bb24@gregkh> (raw)
In-Reply-To: <178183657058.3862365.12892304946786698397@maoyixie.com>
On Fri, Jun 19, 2026 at 10:36:10AM +0800, Maoyi Xie wrote:
> Hi all,
>
> I think the Greybus audio topology parser in
> drivers/staging/greybus/audio_topology.c can read past the topology blob
> when a module reports inconsistent counts.
The kernel trusts the hardware, and the drivers have never been reviewed
or audited for if the hardware does not report the correct data. I'm
sure there are lots of code paths that are buggy if the hardware starts
to do odd things. If this is a threat model you worry about, and wish
to address, wonderful, there should be lots of code to change :)
But for now, Linux assumes that the hardware is trustworthy once a
driver is bound to a device.
thanks,
greg k-h
next prev parent reply other threads:[~2026-06-19 4:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-19 2:36 staging: greybus: audio: possible out of bounds read in the topology parser Maoyi Xie
2026-06-19 4:37 ` Greg Kroah-Hartman [this message]
2026-06-19 5:35 ` Maoyi Xie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026061910-supply-jersey-bb24@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=elder@kernel.org \
--cc=greybus-dev@lists.linaro.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=maoyixie.tju@gmail.com \
--cc=mgreer@animalcreek.com \
--cc=vaibhav.sr@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox