[PATCH] firewire: core-card: fix ROM length mismatch and strengthen descriptor validation

[PATCH] firewire: core-card: fix ROM length mismatch and strengthen descriptor validation

[Sreeraj S Kurup]

The FireWire core had two issues:

1. ROM length mismatch handling:
   Previously, generate_config_rom() only WARNed when the computed
   length differed from config_rom_length. This left the driver in
   an inconsistent state. Now we log a warning and resynchronize
   config_rom_length to the actual value.

2. Descriptor validation:
   fw_core_add_descriptor() only checked internal block consistency.
   We now reject empty descriptors and those exceeding 256 quadlets
   before parsing, preventing malformed input from corrupting the
   config ROM.

These changes improve robustness of the FireWire core against
invalid descriptors and ensure config ROM stays consistent.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 drivers/firewire/core-card.c | 51 ++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 22 deletions(-)

diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index a754c6366b97..97439da6f480 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -143,7 +143,11 @@ static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 	for (i = 0; i < j; i += length + 1)
 		length = fw_compute_block_crc(config_rom + i);
 
-	WARN_ON(j != config_rom_length);
+     if (j != config_rom_length) {
+        pr_warn("FireWire ROM length mismatch: expected %zu, got %d\n",
+            config_rom_length, j);
+        config_rom_length = j;
+     }
 }
 
 static void update_config_roms(void)
@@ -165,33 +169,36 @@ static size_t required_space(struct fw_descriptor *desc)
 
 int fw_core_add_descriptor(struct fw_descriptor *desc)
 {
-	size_t i;
+    size_t i;
 
-	/*
-	 * Check descriptor is valid; the length of all blocks in the
-	 * descriptor has to add up to exactly the length of the
-	 * block.
-	 */
-	i = 0;
-	while (i < desc->length)
-		i += (desc->data[i] >> 16) + 1;
+    /* Extra validation: reject empty or oversized descriptors */
+    if (desc->length == 0 || desc->length > 256)
+        return -EINVAL;
 
-	if (i != desc->length)
-		return -EINVAL;
+    /*
+     * Check descriptor is valid, the length of all blocks in the
+     * descriptor has to add up to exactly the length of the block.
+     */
+    i = 0;
+    while (i < desc->length)
+        i += (desc->data[i] >> 16) + 1;
 
-	guard(mutex)(&card_mutex);
+    if (i != desc->length)
+        return -EINVAL;
 
-	if (config_rom_length + required_space(desc) > 256)
-		return -EBUSY;
+    guard(mutex)(&card_mutex);
 
-	list_add_tail(&desc->link, &descriptor_list);
-	config_rom_length += required_space(desc);
-	descriptor_count++;
-	if (desc->immediate > 0)
-		descriptor_count++;
-	update_config_roms();
+    if (config_rom_length + required_space(desc) > 256)
+        return -EBUSY;
 
-	return 0;
+    list_add_tail(&desc->link, &descriptor_list);
+    config_rom_length += required_space(desc);
+    descriptor_count++;
+    if (desc->immediate > 0)
+        descriptor_count++;
+    update_config_roms();
+
+    return 0;
 }
 EXPORT_SYMBOL(fw_core_add_descriptor);
 
-- 
2.54.0

Re: [PATCH] firewire: core-card: fix ROM length mismatch and strengthen descriptor validation

[kernel test robot]

Hi Sreeraj,

kernel test robot noticed the following build warnings:

[auto build test WARNING on ieee1394-linux1394/for-linus]
[cannot apply to ieee1394-linux1394/for-next next-20260810]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Sreeraj-S-Kurup/firewire-core-card-fix-ROM-length-mismatch-and-strengthen-descriptor-validation/20260811-151106
base:   https://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394.git for-linus
patch link:    https://lore.kernel.org/r/20260720144913.5840-1-sreekuttan2156239%40gmail.com
patch subject: [PATCH] firewire: core-card: fix ROM length mismatch and strengthen descriptor validation
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260811/202608112235.mPi5BN2l-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608112235.mPi5BN2l-lkp@intel.com/

New smatch warnings:
drivers/firewire/core-card.c:146 generate_config_rom() warn: inconsistent indenting

Old smatch warnings:
drivers/firewire/core-card.c:514 bm_work() warn: always true condition '(root_node->max_hops < (16 / 1 + (0))) => (0-15 < 16)'

vim +146 drivers/firewire/core-card.c

    88	
    89	static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
    90	{
    91		struct fw_descriptor *desc;
    92		int i, j, k, length;
    93	
    94		/*
    95		 * Initialize contents of config rom buffer.  On the OHCI
    96		 * controller, block reads to the config rom accesses the host
    97		 * memory, but quadlet read access the hardware bus info block
    98		 * registers.  That's just crack, but it means we should make
    99		 * sure the contents of bus info block in host memory matches
   100		 * the version stored in the OHCI registers.
   101		 */
   102	
   103		config_rom[0] = cpu_to_be32(
   104			BIB_CRC_LENGTH(4) | BIB_INFO_LENGTH(4) | BIB_CRC(0));
   105		config_rom[1] = cpu_to_be32(BIB_BUS_NAME);
   106		config_rom[2] = cpu_to_be32(
   107			BIB_LINK_SPEED(card->link_speed) |
   108			BIB_GENERATION(card->config_rom_generation++ % 14 + 2) |
   109			BIB_MAX_ROM(2) |
   110			BIB_MAX_RECEIVE(card->max_receive) |
   111			BIB_BMC | BIB_ISC | BIB_CMC | BIB_IRMC);
   112		config_rom[3] = cpu_to_be32(card->guid >> 32);
   113		config_rom[4] = cpu_to_be32(card->guid);
   114	
   115		/* Generate root directory. */
   116		config_rom[6] = cpu_to_be32(NODE_CAPABILITIES);
   117		i = 7;
   118		j = 7 + descriptor_count;
   119	
   120		/* Generate root directory entries for descriptors. */
   121		list_for_each_entry (desc, &descriptor_list, link) {
   122			if (desc->immediate > 0)
   123				config_rom[i++] = cpu_to_be32(desc->immediate);
   124			config_rom[i] = cpu_to_be32(desc->key | (j - i));
   125			i++;
   126			j += desc->length;
   127		}
   128	
   129		/* Update root directory length. */
   130		config_rom[5] = cpu_to_be32((i - 5 - 1) << 16);
   131	
   132		/* End of root directory, now copy in descriptors. */
   133		list_for_each_entry (desc, &descriptor_list, link) {
   134			for (k = 0; k < desc->length; k++)
   135				config_rom[i + k] = cpu_to_be32(desc->data[k]);
   136			i += desc->length;
   137		}
   138	
   139		/* Calculate CRCs for all blocks in the config rom.  This
   140		 * assumes that CRC length and info length are identical for
   141		 * the bus info block, which is always the case for this
   142		 * implementation. */
   143		for (i = 0; i < j; i += length + 1)
   144			length = fw_compute_block_crc(config_rom + i);
   145	
 > 146	     if (j != config_rom_length) {
   147	        pr_warn("FireWire ROM length mismatch: expected %zu, got %d\n",
   148	            config_rom_length, j);
   149	        config_rom_length = j;
   150	     }
   151	}
   152	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki