[PATCH] ALSA: fireworks: bound device-supplied status before string array lookup

[PATCH] ALSA: fireworks: bound device-supplied status before string array lookup

[Greg Kroah-Hartman]

The status field in an EFW response is a 32-bit value supplied by the
firewire device.  efr_status_names[] has 17 entries so a status value
outside that range goes off into the weeds when looking at the %s value.

Even worse, the status could return EFR_STATUS_INCOMPLETE which is
0x80000000, and is obviously not in that array of potential strings.

Fix this up by properly bounding the index against the array size and
printing "unknown" if it's not recognized.

Cc: Clemens Ladisch <clemens@ladisch.de>
Cc: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Fixes: bde8a8f23bbe ("ALSA: fireworks: Add transaction and some commands")
Cc: stable <stable@kernel.org>
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/firewire/fireworks/fireworks_command.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/firewire/fireworks/fireworks_command.c b/sound/firewire/fireworks/fireworks_command.c
index 2b595ee0bc35..05550f36fac5 100644
--- a/sound/firewire/fireworks/fireworks_command.c
+++ b/sound/firewire/fireworks/fireworks_command.c
@@ -151,10 +151,13 @@ efw_transaction(struct snd_efw *efw, unsigned int category,
 	    (be32_to_cpu(header->category) != category) ||
 	    (be32_to_cpu(header->command) != command) ||
 	    (be32_to_cpu(header->status) != EFR_STATUS_OK)) {
+		u32 st = be32_to_cpu(header->status);
+
 		dev_err(&efw->unit->device, "EFW command failed [%u/%u]: %s\n",
 			be32_to_cpu(header->category),
 			be32_to_cpu(header->command),
-			efr_status_names[be32_to_cpu(header->status)]);
+			st < ARRAY_SIZE(efr_status_names) ?
+				efr_status_names[st] : "unknown");
 		err = -EIO;
 		goto end;
 	}
-- 
2.53.0

Re: [PATCH] ALSA: fireworks: bound device-supplied status before string array lookup

[Takashi Sakamoto]

Hi,

On Thu, Apr 09, 2026 at 04:05:54PM +0200, Greg Kroah-Hartman wrote:
> The status field in an EFW response is a 32-bit value supplied by the
> firewire device.  efr_status_names[] has 17 entries so a status value
> outside that range goes off into the weeds when looking at the %s value.
> 
> Even worse, the status could return EFR_STATUS_INCOMPLETE which is
> 0x80000000, and is obviously not in that array of potential strings.
> 
> Fix this up by properly bounding the index against the array size and
> printing "unknown" if it's not recognized.
> 
> Cc: Clemens Ladisch <clemens@ladisch.de>
> Cc: Takashi Sakamoto <o-takashi@sakamocchi.jp>
> Cc: Jaroslav Kysela <perex@perex.cz>
> Cc: Takashi Iwai <tiwai@suse.com>
> Fixes: bde8a8f23bbe ("ALSA: fireworks: Add transaction and some commands")
> Cc: stable <stable@kernel.org>
> Assisted-by: gregkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  sound/firewire/fireworks/fireworks_command.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Good catch.

Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>


Thanks

Takashi Sakamoto