linux-kernel - Re: [PATCH] ASoC: max98390: Fix potential crash during param fw loading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200603114241.GD5327@sirena.org.uk>
Date:   Wed, 3 Jun 2020 12:42:41 +0100
From:   Mark Brown <broonie@...nel.org>
To:     Steve Lee <SteveS.Lee@...imintegrated.com>
Cc:     "lgirdwood@...il.com" <lgirdwood@...il.com>,
        "perex@...ex.cz" <perex@...ex.cz>,
        "tiwai@...e.com" <tiwai@...e.com>,
        "ckeepax@...nsource.cirrus.com" <ckeepax@...nsource.cirrus.com>,
        "geert@...ux-m68k.org" <geert@...ux-m68k.org>,
        "rf@...nsource.wolfsonmicro.com" <rf@...nsource.wolfsonmicro.com>,
        "shumingf@...ltek.com" <shumingf@...ltek.com>,
        "srinivas.kandagatla@...aro.org" <srinivas.kandagatla@...aro.org>,
        "krzk@...nel.org" <krzk@...nel.org>,
        "dmurphy@...com" <dmurphy@...com>,
        "jack.yu@...ltek.com" <jack.yu@...ltek.com>,
        "nuno.sa@...log.com" <nuno.sa@...log.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "alsa-devel@...a-project.org" <alsa-devel@...a-project.org>,
        "ryan.lee.maxim@...il.com" <ryan.lee.maxim@...il.com>,
        Ryan Lee <RyanS.Lee@...imintegrated.com>,
        "steves.lee.maxim@...il.com" <steves.lee.maxim@...il.com>
Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw
 loading

On Wed, Jun 03, 2020 at 11:37:44AM +0000, Steve Lee wrote:

> > This is now reading the size out of the header of the file which is good but it
> > should also validate that the file is big enough to have this much data in it,
> > otherwise it's possible to read beyond the end of the firmware file (eg, if it got
> > truncated somehow).  Previously the code used the size of the file read from disk
> > so that wasn't an issue.

>  Thanks for quick comment. Can this case cover by below line?
> +	if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
> +		dev_err(component->dev,
> +			"param fw is invalid.\n");
> +		goto err_alloc;
> +	}

No, that doesn't cover all of it - the case I'm concerned about is the
case where we've got enough data for the header but the payload is
truncated.  You need a check that param_size + _PAYLOAD_OFFSET is less
than fw->size as well.

Download attachment "signature.asc" of type "application/pgp-signature" (485 bytes)