From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f171.google.com (mail-qt1-f171.google.com [209.85.160.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A298335F180 for ; Tue, 16 Jun 2026 07:42:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781595772; cv=none; b=pY4rCXQ6PkqhRrWFsG8BjEQtvtJUJ//LBw6p3tLu/tjLzf2LeOJ4/Am3VQGZ9sPqFmoINGK77H/qVWF3s6PguR8+MY7AvmcCDCP7b3SawewszB0SlggF8+hv3N3ECVOPVDpodbtuTK3ifl7fAektEExjFBnHeIpIdAkd87k3Pps= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781595772; c=relaxed/simple; bh=yTQpcE6hgSL8qmLNr43zEcE6tGMMwDLIqq6M8DR7nnc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=iLAW0UW12aEKDVYO1snT7Zu9RMNS+xzTWhHwRfb2S/FENFyBAiJQG7sEQNOifvbEAiRiP7hnMEsrkVQucN31y1wuSp/bAzWcOihKtIHg2bas24y+1lltmcy5ULzahadZIZgI1/oEWiufnvgPkx2qfnbnrytCaYu6T34ehJcLAKk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dHYiL1Gr; arc=none smtp.client-ip=209.85.160.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dHYiL1Gr" Received: by mail-qt1-f171.google.com with SMTP id d75a77b69052e-51761d27612so51301801cf.3 for ; Tue, 16 Jun 2026 00:42:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781595770; x=1782200570; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=v3vSm8eD6FMJPEneyrT8INZ/0kUYiIyKIleKMlOU9h8=; b=dHYiL1Grrmf5P8gihfLSIyklvAZaLR0Ko6DGF79rPZ7a5E+tZNTFDJP7CqDmMwVwip VVhVUOX/OdKDU6CWUh0A8szkHqXuEbpFUlKIJTCtZSlvEEeVj17C1S3yQOepJ7x4Dwb9 M66bisnhQvfgo+PJX4LCCb4RawD49/b5hbLEIPJ0ta8tND+zcA0Q/OxRXUpB2sXc8efM LyO0QoxEfDDdMZ4j2xvgrUmX8Ydkot4+mOjJgBGAh5M/4ADdMUhBUOn6jWLQ7tkUnA4S flMZX8dWwx9xJl3NGuyY9KF1bo90iWt9I2IWdha9cBV/AU4kHinT4sFg6nhtF5Kqk7u0 D4sQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781595770; x=1782200570; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=v3vSm8eD6FMJPEneyrT8INZ/0kUYiIyKIleKMlOU9h8=; b=qPv2QAaOd7Yb0wT4HjO3R9omk1+vy/HAu17Yt3fQV1igVaeTHVA4+vLokq8bfxTfgy Z40UDjsWZIOcDelPrCSZceBc0BzvLPcAKA5u7JfXoOmfE+pXRawa9ClIURjE2KMCZYYQ 2+9NkdrLB1GqnFh2xcuD6EPDEwYxR+E6RGL3XtMXuqcQRUCyXqI2E7rqvDGr5p9iBfBF 1QxX4pbXp1/R1XeEo5esfa2sfwpuhsvT782LOLtvQKu5MipE+dbKV61SZhbllmhpfFz1 bOf6TPBpa7pT/CyDhRXjrygH0fewsQUGYj8BZbt/aRfvyt6wjmzVqSqsqvVh1ozSYFkm AqQw== X-Forwarded-Encrypted: i=1; AFNElJ8rZV02ySD7ylx3zmu6z26QO/9M45KVrkHqUQLaqRGDjNE+Mf87CNEnU19DrrnSLKDzFxPxULJX/DXtJ10=@vger.kernel.org X-Gm-Message-State: AOJu0Yx7ByI7UE4DZew5bSm4v2TmIjgfhtvG6QeQAq6PUQr9bZpFLX+2 nnflqg1mjFjl+8pOM78VRPKsri46uduxypUxvu2UASM6/I0OwJ66gNB5 X-Gm-Gg: Acq92OGoZrK5gj7dqeKEEdFMGkmGuPRpaGENaNzBECEaAIV60SS2mQFsMButBJKEyQB sY33elj9JQ+IuHm4obGaIZ55yT0Ndv2ZrZXMAkA1zm25PfIJ+Ajbcn1V5u7o3DnGnksyZioVR+W Q0W5+GY22OyuVjlib9P97KK1ipr7fgiVFXb8dADLemdD3NUV5L6pZ1Pk450UXKBWCAGWgO9nS1P x5mATHZBPchf83q0eP2bi1RpokSsRd37+mGcX034Kc7vRCev7sWTulupyse7gGWYUKlCIWG7TIy OBnxRJSiHPld+s0gFQAh3GQpgJfvKStSzKFuew4htf/563Bt+6YOoZuVwQyyZmtKmDsyLj24656 bwzpIOloEY2qgqc2Rfq60aNZ7OmVIxhQWkogyYlsi1AbE/RsSsSDJkvhsmIyDajm7CRfcPvj/oI f0koBdMjJ0BiDAhGr2L4eIla4HkPU= X-Received: by 2002:a05:622a:487:b0:517:82a1:adf1 with SMTP id d75a77b69052e-51991592438mr34332981cf.15.1781595770695; Tue, 16 Jun 2026 00:42:50 -0700 (PDT) Received: from localhost ([43.225.189.75]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-517fb6428a6sm154779031cf.12.2026.06.16.00.42.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 00:42:49 -0700 (PDT) Date: Tue, 16 Jun 2026 10:42:43 +0300 From: Dan Carpenter To: Greg Kroah-Hartman Cc: hexlabsecurity@proton.me, Mark Greer , Vaibhav Agarwal , Johan Hovold , linux-kernel@vger.kernel.org, linux-staging@lists.linux.dev, greybus-dev@lists.linaro.org, Alex Elder Subject: Re: [PATCH] greybus: audio: bound the topology section sizes against the fetched size Message-ID: References: <20260616-b4-disp-4352e8b0-v1-1-3e09f62e0ad5@proton.me> <2026061643-crowbar-handgrip-620d@gregkh> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2026061643-crowbar-handgrip-620d@gregkh> On Tue, Jun 16, 2026 at 12:01:30PM +0530, Greg Kroah-Hartman wrote: > On Tue, Jun 16, 2026 at 01:06:12AM -0500, Bryam Vargas via B4 Relay wrote: > > --- > > drivers/staging/greybus/audio_gb.c | 13 +++++++++++++ > > 1 file changed, 13 insertions(+) > > > > diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c > > index 9d8994fdb41a..144591f1a512 100644 > > --- a/drivers/staging/greybus/audio_gb.c > > +++ b/drivers/staging/greybus/audio_gb.c > > @@ -37,6 +37,19 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, > > return ret; > > } > > > > + /* > > + * The size_* fields are supplied by the module and are used by > > + * gbaudio_tplg_parse_data() to compute offsets into the blob; make > > + * sure the sections fit within the fetched topology, so walking it > > + * cannot read out of bounds. > > + */ > > + if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) + > > + le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) > > > + size - sizeof(*topo)) { > > Are you sure these checks will not overflow? Yep. The cast to u64 ensures that. regards, dan carpenter