[PATCH v3 0/2] media: s2255: Fix firmware parsing OOB and cleanup coding style

[PATCH v3 0/2] media: s2255: Fix firmware parsing OOB and cleanup coding style

[Lei Huang]

From: Lei Huang <huanglei@kylinos.cn>

Hi maintainers and reviewers,

This patch series includes two improvements for the s2255 USB driver,
specifically focusing on the s2255_probe() function.

Patch 1/2 fixes a potential out-of-bounds memory access vulnerability.
The driver previously read firmware marker data from the end of the blob
without validating the file size. If the firmware is smaller than 8 bytes,
this leads to an underflow and invalid memory access. This patch adds a
size check to ensure safe access.

Patch 2/2 is a cosmetic cleanup that renames CamelCase goto labels to
snake_case to comply with the Linux kernel coding style. This improves
readability and consistency with the rest of the kernel tree. While this
patch introduces no functional changes, it touches the same error-handling
paths modified in the first patch, so they are submitted together for
contextual clarity.

Lei Huang (2):
  media: s2255: check firmware size before reading trailing marker
  media: s2255: Rename CamelCase goto labels to snake_case

 drivers/media/usb/s2255/s2255drv.c | 41 +++++++++++++++++-------------
 1 file changed, 23 insertions(+), 18 deletions(-)

-- 
2.25.1

[PATCH v3 1/2] media: s2255: check firmware size before reading trailing marker

[Lei Huang]

From: Lei Huang <huanglei@kylinos.cn>

s2255_probe() reads a 4-byte marker and version from the last 8 bytes
of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the
firmware file is shorter than 8 bytes, fw_size - 8 underflows and the
access reads out of bounds. Validate the firmware size before indexing.

Fixes: 14d962602c8b ("V4L/DVB (8752): s2255drv: firmware improvement patch")
Signed-off-by: Lei Huang <huanglei@kylinos.cn>
---
 drivers/media/usb/s2255/s2255drv.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index 0b8182edf8e4..3917913c3b47 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -2277,6 +2277,11 @@ static int s2255_probe(struct usb_interface *interface,
 	}
 	/* check the firmware is valid */
 	fw_size = dev->fw_data->fw->size;
+	if (fw_size < 8) {
+		dev_err(&interface->dev, "Firmware invalid: too small.\n");
+		retval = -ENODEV;
+		goto errorFWMARKER;
+	}
 	pdata = (__le32 *) &dev->fw_data->fw->data[fw_size - 8];
 
 	if (*pdata != S2255_FW_MARKER) {
-- 
2.25.1

Re:Re: [v3,0/2] media: s2255: Fix firmware parsing OOB and cleanup coding style

[huanglei]

Hi,

Thanks a lot for your review feedback. This version of the patch series is submitted ‌fully in strict accordance with maintainer suggestions‌:

 The critical functional fix media: s2255: check firmware size before reading trailing marker is placed as the first patch independently. It resolves the out-of-bounds read vulnerability completely with no unrelated style changes, which is very convenient for direct stable backporting.
 The subsequent media: s2255: Rename CamelCase goto labels to snake_case cleanup patch is placed on top of the fix, as a separate pure non-functional commit to unify all the error path labels to comply with kernel coding style.

This ordering and split of commits fully follow maintainer advice to make the series easy to merge, review and backport. The final applied state has no remaining non-standard CamelCase labels and meets Linux kernel coding style requirements.

For the earlier CI CamelCase warning, it only exists temporarily on the first independent fix patch, and the full series after the two patches are applied will eliminate all such non-standard naming.


On 15/07/2026 12:00, Johan Hovold wrote:
> This looks ok, but the fix should go before the cleanup (e.g. to
> facilitate backporting).


At 2026-07-16 13:05:12, "Patchwork Integration" <patchwork@media-ci.org> wrote:
>Dear Lei Huang:
>
>Thanks for your patches! Unfortunately the Media CI robot detected some
>issues:
>
># Test checkpatch:./0001-media-s2255-check-firmware-size-before-reading-trail.patch checkpatch
>CHECK: Avoid CamelCase: <errorFWMARKER>
>#30: FILE: drivers/media/usb/s2255/s2255drv.c:2283:
>+goto errorFWMARKER;
>
>total: 0 errors, 0 warnings, 1 checks, 11 lines checked
>
>
>
>Please fix your series, and upload a new version. If you have a patchwork
>account, do not forget to mark the current series as Superseded.
>
>For more details, check the full report at:
>https://linux-media.pages.freedesktop.org/-/users/patchwork/-/jobs/105100498/artifacts/report.htm .
>
>
>
>Best regards, and Happy Hacking!
>Media CI robot on behalf of the linux-media community.
>
>---
>Check the latest rules for contributing your patches at:
>https://docs.kernel.org/driver-api/media/maintainer-entry-profile.html
>
>If you believe that the CI is wrong, kindly open an issue at
>https://gitlab.freedesktop.org/linux-media/media-ci/-/issues or reply-all
>to this message.