From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8ED30348886 for ; Fri, 10 Jul 2026 14:22:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783693341; cv=none; b=Y97x996zuN+wrzrW5X6S0XT2wXVe5EjmDMHZtuVuLUJpDih29VS3m2J8CoA1xSGFIaQToKs3llDwgeR44LrkbPoaZvFlA446fzvz86HZ4n7ol2r3LsJcrnA1T6HpEn5COm6J9iGy+vmhxQ5t6MQmjBhDPVbeoc9WHFyW0tHA0ok= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783693341; c=relaxed/simple; bh=6hgT5DK0oOq5/Wsou8lo8FKxq+iZjqEUc+JvtN+p1Ng=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OjHj7awuYc6BEQElqIZvbN85sZsalEytghqqe8+JtRQzkN9o/Q8UgMYZ8d+SWtWuyHQuKj5EM3oRwd4G0rUI34ap73WAOni8qz59EU1GwxA+gK7MOFRIkESQJtA13h19m5ZnvdDx8gwaD4uZGr3OY8wOWiMlZtwY8dRK2pmliuU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=koa+HvEO; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="koa+HvEO" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2ce87c7e3bbso8032615ad.1 for ; Fri, 10 Jul 2026 07:22:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783693340; x=1784298140; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=FoLPitrFKeUob810vvgoU4umxRfKuy0C/dr9NicwKbA=; b=koa+HvEO7lg9XcgkLN2/bl9mT5SeCgfUW5Wm50PElj0/sM7MUMXn80hRtUaLko99WZ mfZQtFGnh7XSERhoNftFrOx6u56h+Z2o1ct913mI2bVIv4TR5XFrqNimv+xCteqnhrd8 TyqqJlgx3VVyYclVUidRgrsAt7KoXkwSVrxtUBaTEYIMitTaRz2OUs0kxPJWFfvFQkzK aHmsZPcWOga8y03UvuAvRS1uRg7T3hTAWMzOlFmCntmMEZnNFZT7QAxP+MMxZsBk1Xaw POwfKz2AWsJc8l9lKN5lL2MXrfvPm2RpriW1JcVmSuTdxHkm8a494oaUQJMhOf6Am93s ePlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783693340; x=1784298140; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FoLPitrFKeUob810vvgoU4umxRfKuy0C/dr9NicwKbA=; b=aHRAzbL9PvCeMjYxteHgQaH/MWhb0ppHKt/Cb8+5wE+hcFWh2pEXG79mg0Xh2wvd/8 JsllH+kUHvwCljK1RHSt65Y7+iYE8m2GcF+1sDup8tciwm7n2fSQ3Ivi2OydMr+W5Y8l bzgcI9NOYn/gQPKen15IbR6YV08l+G+pAyhVaa+h8bf7I13GPlHbpbIG8tfNLLwRSt/G VbXhndVCpUh5PJx1T9oKg+hg4BCBQGZ1K+s6CdNjVmrG9WyMrygdgQqdb2hqye/AUTJG ce4FJW42yUpIyiwyaiHlSLBsNQ3cjPLKEYnIIzi0AIqm/2NSrx2/eKLUkTiAGLylpDFZ 9LPg== X-Forwarded-Encrypted: i=1; AHgh+Rov5cvgJ4xWl+Dt2+S4uL9f2vzWY0hzNLOECDRP3aKjLmmRWueV5jK93d4vwxQ3C8MWIHu+xaX/XQysaeM=@vger.kernel.org X-Gm-Message-State: AOJu0YzhlytLnIRM5LIr8rLvxSleolA0gveI1rLrkudV4shf1xtz7J86 8lFvaeKOWLYQ6DgIf4QThXFsYxMavVxtCFR+LQAxBu8vCoxyXVm+wCH7 X-Gm-Gg: AfdE7cnFj7G6WjYXIQRPuw3x223J4mAm4LnraEL3OVyfiGD3jhvVTeceSjKPXAqUxPH Oj9Qf460bV3Ioc1SOpvXGfPbEBX0B9/jg0YSJ5pT1PzQPYuk4jAyU7hV0JMCnff9R1pMsDPP36b 2uQk2Fh8JVsqmb+JKYCVEiu0S4Neii+bsUkDt2p8G/nJqzTOnNXqrIJcZ9sTcWQ8hlS48ngrb3t rlsEiBTheUlLAJFwleRpn7tsFJyS+dtQc5V85oCc/VuB3jO5jXf+YTaNq5z4Rebh+zvqBpUAsZq 0eHoz+CydRud7tKqoQi8ItMWh+bU1Q+au/fEBBUHupsg5qbyQ2Nd3cE3guVGcjmPI2i4ubxdLD/ /Its8xa9CysckWJe7bOcSRxnM0BdUQFpaNk81YD7ncstbx+POOlCb0RGKDqj0iBp9HAvniTd5ex 23ooFU/88pWMvK7q+Ox+5eysqkfoo3OstFJTNt1B9BR05vPcvgrBABNSNTSKELQw== X-Received: by 2002:a05:6a20:a124:b0:3bf:b089:c55e with SMTP id adf61e73a8af0-3c0bcc23bbfmr14504856637.52.1783693339957; Fri, 10 Jul 2026 07:22:19 -0700 (PDT) Received: from localhost.localdomain ([2405:acc0:1306:5177:3103:5737:1752:bd47]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13b659d7c8bsm45575083c88.12.2026.07.10.07.22.16 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 10 Jul 2026 07:22:19 -0700 (PDT) From: Laxman Acharya Padhya To: Jonathan Cameron Cc: David Lechner , =?UTF-8?q?Nuno=20S=C3=A1?= , Andy Shevchenko , Yasin Lee , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] iio: proximity: hx9023s: validate firmware size Date: Fri, 10 Jul 2026 20:07:12 +0545 Message-ID: <20260710142212.52225-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit hx9023s_send_cfg() copies the firmware into a counted flexible array and then reads fixed offsets from the copied data before walking register/value pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore make the driver read past the copied buffer during probe-time configuration loading. Reject firmware images that cannot contain the fixed header, reject images too large for the u16 fw_size field, and validate that the advertised register count fits in the remaining payload. Move release_firmware() to the callback so the firmware object is released on all hx9023s_send_cfg() error paths. Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/iio/proximity/hx9023s.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c index a6ff7cbe9e6..a2f9c077e58 100644 --- a/drivers/iio/proximity/hx9023s.c +++ b/drivers/iio/proximity/hx9023s.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -25,6 +26,7 @@ #include #include #include +#include #include #include @@ -1031,8 +1033,12 @@ static int hx9023s_bin_load(struct hx9023s_data *data, struct hx9023s_bin *bin) static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data) { - struct hx9023s_bin *bin __free(kfree) = - kzalloc(fw->size + sizeof(*bin), GFP_KERNEL); + struct hx9023s_bin *bin __free(kfree) = NULL; + + if (fw->size < FW_DATA_OFFSET || fw->size > U16_MAX) + return -EINVAL; + + bin = kzalloc(sizeof(*bin) + fw->size, GFP_KERNEL); if (!bin) return -ENOMEM; @@ -1041,7 +1047,8 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data bin->fw_ver = bin->data[FW_VER_OFFSET]; bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET); - release_firmware(fw); + if (bin->reg_count > (bin->fw_size - FW_DATA_OFFSET) / 2) + return -EINVAL; return hx9023s_bin_load(data, bin); } @@ -1058,6 +1065,7 @@ static void hx9023s_cfg_update(const struct firmware *fw, void *context) } ret = hx9023s_send_cfg(fw, data); + release_firmware(fw); if (ret) { dev_warn(dev, "Firmware update failed: %d\n", ret); goto no_fw; base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 -- 2.51.2