From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 767E9B67E; Wed, 8 Apr 2026 18:17:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672255; cv=none; b=Dhk6CxWLTx92+D+pQzAEnaorK+M1JNBnY8h5WzFENHHZyzmx9RaD3ns1tKaVs4O9DnMqat4NlayJrnwhbJieuBoE5Fy7LLkx5RUScGjFi1ZInHrbsl5LU+Kl2C/j2rdj8yC5O0R8s8G4GHYVDetps+abH4Yogz/7354ecDzU0wc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672255; c=relaxed/simple; bh=dsQB7hgZkD6w/E2waNkCUq+gCZu2xDjKbcxVfBGVufo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=idLyGdhayNxgEls8YAP6o7k1AnwOFx6482LifE2UatC2bu9shtpH4vEA/IyhsQVWW94d2vrn2U34lFFR2rVgoQbG9VzqycjgZ1nbuoSYNdybZgGPvUMvcgk18lxtI1iqJd+ChrjGvcx5TQbOYJbX+zydAMvvRsKRUI77cj1Ttb0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=njUI6qiv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="njUI6qiv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03AB5C19421; Wed, 8 Apr 2026 18:17:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775672255; bh=dsQB7hgZkD6w/E2waNkCUq+gCZu2xDjKbcxVfBGVufo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=njUI6qivm8Rd3DQUADdqARY3Wd6Sb1uhcJ/6ORc7P3NqkzCYy6GVbCRLP2RCSNtjD di8Vd/SAVnIkKsxHFV2251hutbTlNzJzQqIjD+Bwu71104Zq6LRNORGs7cdL1ZVGya a+UWubWctZUey7j2oKLpRdTXYjJliHdEepKoZLd8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Ian Abbott Subject: [PATCH 6.1 249/312] comedi: me_daq: Fix potential overrun of firmware buffer Date: Wed, 8 Apr 2026 20:02:46 +0200 Message-ID: <20260408175943.045331423@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260408175933.715315542@linuxfoundation.org> References: <20260408175933.715315542@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ian Abbott commit cc797d4821c754c701d9714b58bea947e31dbbe0 upstream. `me2600_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Although it checks that the supplied firmware is at least 16 bytes long, it does not check that it is long enough to contain the data stream. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Fixes: 85acac61096f9 ("Staging: comedi: add me_daq driver") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260205140130.76697-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman --- drivers/comedi/drivers/me_daq.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) --- a/drivers/comedi/drivers/me_daq.c +++ b/drivers/comedi/drivers/me_daq.c @@ -344,6 +344,25 @@ static int me2600_xilinx_download(struct unsigned int file_length; unsigned int i; + /* + * Format of the firmware + * Build longs from the byte-wise coded header + * Byte 1-3: length of the array + * Byte 4-7: version + * Byte 8-11: date + * Byte 12-15: reserved + */ + if (size >= 4) { + file_length = (((unsigned int)data[0] & 0xff) << 24) + + (((unsigned int)data[1] & 0xff) << 16) + + (((unsigned int)data[2] & 0xff) << 8) + + ((unsigned int)data[3] & 0xff); + } + if (size < 16 || file_length > size - 16) { + dev_err(dev->class_dev, "Firmware length inconsistency\n"); + return -EINVAL; + } + /* disable irq's on PLX */ writel(0x00, devpriv->plx_regbase + PLX9052_INTCSR); @@ -358,22 +377,6 @@ static int me2600_xilinx_download(struct sleep(1); /* - * Format of the firmware - * Build longs from the byte-wise coded header - * Byte 1-3: length of the array - * Byte 4-7: version - * Byte 8-11: date - * Byte 12-15: reserved - */ - if (size < 16) - return -EINVAL; - - file_length = (((unsigned int)data[0] & 0xff) << 24) + - (((unsigned int)data[1] & 0xff) << 16) + - (((unsigned int)data[2] & 0xff) << 8) + - ((unsigned int)data[3] & 0xff); - - /* * Loop for writing firmware byte by byte to xilinx * Firmware data start at offset 16 */