From nobody Sat Aug 1 21:31:56 2026 Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75DA42D3A75 for ; Sat, 1 Aug 2026 19:37:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785613029; cv=none; b=btU24o8/5dDz9bJ1qBnEY9tBXWHMfhVXzH+K1CerhrbE/VvQL/8Z6aJO3sC1f0G3xIhS/TJgA2a1BQkO9rgSw6s5QvLYcRlGGnflznDLtagloXqYUeafUaNkXYSamI32bn7IszV5Bp3bsSZewBUpeAOwX9QwE68NPANdGiRimVo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785613029; c=relaxed/simple; bh=wAj8JaFRhBUgHCCzKMI5KnjYQwsnchef6V3NCmE0v+c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gp1XbukcSksDfO3t2fVmgCJBI1rZkRnzxAhB2D7/RFRFWnISD6ATvENVuxIBWOKK9le1LZw+WNkC8ywTTMz18riVumzFXvvNs65ijtmORiaODErnF5A3RC+29ordAeQjaNsZ/uvrKA5cQXxLmLTpcCECzakUeJ8vXvpmQovx3HY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Rpzu0BDu; arc=none smtp.client-ip=209.85.210.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Rpzu0BDu" Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-8423f236418so1782556b3a.1 for ; Sat, 01 Aug 2026 12:37:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785613028; x=1786217828; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=J0Mm4VFPxuz6DlppF/PVGQY5b2FJs3BtOYyEAOnWBOk=; b=Rpzu0BDuxhw1oID6ARidXmHAnaRGMf4xOYBLtqqxJxb5mqv4FxbVqIHZW9Mx5L3N/z +XVDPqKYjMyxSIAifzF8bCybvT4nFOhbaHNhmu9vwyhz973WKZomcOHVlqr7xshj5LYb rwfP0h/1uVTKIGIdcUBYB3aap5vSxvtC2BYPv19absMdeAxi2IsTlVcdhZDsxYbMHDuJ 6PgPMh89CtmPjd0A6/HiSoGEGc7smeEw7x7FW/w2SmJTEocQDMPEQOzqgEuykjnhWdbX VCrjYaJURrSeBXm+EVYYO8QFJqsjumS6kd7OwovJSemix4R3NvSYJUlwPfiNVW1qzW91 a50w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785613028; x=1786217828; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=J0Mm4VFPxuz6DlppF/PVGQY5b2FJs3BtOYyEAOnWBOk=; b=NxJgpFaUGL4Wbquqq6SYoKrto/713rlYDX1yVZZ1FXm6DE/Y+foQjPQq5OLDxuhL1g lk/xHSAJGkDzS2r5JP+avjoSvkO4bR2dem7QvtDzE18+yx7qcCTsTfIEJHxj9vuh8d7B LMuoXC/SM+K8LyTpYU5Vl1bz3YWeLrPjPeSJ9PlE2GNIYRKnsdxrZL94QCGeWPnWvYMJ N7rcN+9O6CeKWQNXFz+5E99HbgY+V5qksmDYKv48cuQo5sSxoPjyP7Odf7B0R3zAS5yv gxsf6fY8Gjbu4fnPxdOB0JpyAauJIOk6uZeV1gmkxtc4wmP1Eji54jtr2x7AIZvQRf1n uYNA== X-Forwarded-Encrypted: i=1; AHgh+RrMGbMgnf0LHMV4N4GEg7z3d5y3dalqe2Rq0bWs3j7FLMe119PRvlVSfMlTTIiou3zhjHAxXpDLA5hFLxM=@vger.kernel.org X-Gm-Message-State: AOJu0YxwiyomUhcjCPEOQL7z2PT7iA5BgCbxFA1xIT05UGAX4j1wg59/ c47cpW1KR1ITD07SaJEYiUFY0858xQUnWQIQGP/dIOheLNuw8QZ11GQuXUt68ZkE X-Gm-Gg: AR+sD13pcqTn0Eh1eMJRc6f5vriXFMAwdQAPuioGBP3JTxbJSStfBMdU/d9iGyMDXu4 d4bltonLI5Or7X2dXy3+eXJ2XqukKge/zO6qZ0sDtP/suiZJuxtn8uPRTsY7pmLJlIP/xGLfK3o U8D2FK5gX5BQ3TvN5GpAeQZGVajolvamYKwBE8xMShCGa2ahhGAup0Po5CFNkpOXPHjeNxEIGhj 5bpFifOxw+ZU+A0pYT/54pXVvhB06XAiozIclc2eNEGZJhynCc3e2aj8Ryuu3QDRy8ZTFOBvZmG YCc9SNoUL0UlF1mnBab6R8Hb0c6kVPvGGKvRajksYDL3ghC4umpc+6IU09j432KwTub7lmG+Mnr 2+VtzPZPBPqYbu2yYrvyeOqqeXEjjA5XzxJayn1NpDm6nfYH8ZbpQFv9KlYcC9F9KVbEbED9ySn o9CPs3biscZyu0do+30pChVcPr0w3Imak/LgkUfhXHmc6CRze6OQL2eqyEoahaIfgAbRytWLDGl rx2l3Z3b1CzxFsl+hjR3MAIx91B4G4wwAd64CQiCTjilurx/CjzyxRmN0hP2riYcoKVb7mD80Gj bfQAeLIZvAYtPig0UuoaS+bpP+vmKg== X-Received: by 2002:a05:6a21:9cca:b0:3c6:3c5b:f2e1 with SMTP id adf61e73a8af0-3c92a857315mr4522356637.32.1785613027720; Sat, 01 Aug 2026 12:37:07 -0700 (PDT) Received: from localhost.localdomain ([2405:acc0:1306:9d5b:7865:f907:f2bf:8664]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13fab050d8csm29842414c88.0.2026.08.01.12.37.04 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 01 Aug 2026 12:37:07 -0700 (PDT) From: Laxman Acharya Padhya To: Jonathan Cameron Cc: David Lechner , =?UTF-8?q?Nuno=20S=C3=A1?= , Andy Shevchenko , shuaijie wang , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] iio: proximity: aw96103: validate firmware data length Date: Sun, 2 Aug 2026 01:22:00 +0545 Message-ID: <20260801193700.57457-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length. Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. Validate the header size, reject an underflowed length, ensure the resulting payload is contained in the firmware image, and require it to contain whole register/value entries. Fixes: 07b241262dca ("iio: proximity: aw96103: Add support for aw96103/aw96= 105 proximity sensor") Link: https://lore.kernel.org/r/20260314-iio-proximity-aw96103-fix-firmware= -read-v1-1-c74fe9ccd82b@baylibre.com Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya --- drivers/iio/proximity/aw96103.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/drivers/iio/proximity/aw96103.c b/drivers/iio/proximity/aw9610= 3.c index 8fbb755dc..8352d51e5 100644 --- a/drivers/iio/proximity/aw96103.c +++ b/drivers/iio/proximity/aw96103.c @@ -24,6 +24,7 @@ #define AW96103_BIN_VALID_DATA_OFFSET 64 #define AW96103_BIN_DATA_LEN_OFFSET 16 #define AW96103_BIN_DATA_REG_NUM_SIZE 4 +#define AW96103_BIN_REG_SIZE 6 #define AW96103_BIN_CHIP_TYPE_SIZE 8 #define AW96103_BIN_CHIP_TYPE_OFFSET 24 =20 @@ -229,14 +230,27 @@ static const struct aw_chip_info aw_chip_info_tbl[] = =3D { }, }; =20 -static void aw96103_parsing_bin_file(struct aw_bin *bin) +static int aw96103_parsing_bin_file(struct aw_bin *bin) { + u32 data_len; + + if (bin->len < AW96103_BIN_VALID_DATA_OFFSET) + return -EINVAL; + + data_len =3D get_unaligned_le32(bin->data + AW96103_BIN_DATA_LEN_OFFSET); + if (data_len < AW96103_BIN_DATA_REG_NUM_SIZE) + return -EINVAL; + + bin->valid_data_len =3D data_len - AW96103_BIN_DATA_REG_NUM_SIZE; + if (bin->valid_data_len > bin->len - AW96103_BIN_VALID_DATA_OFFSET || + bin->valid_data_len % AW96103_BIN_REG_SIZE) + return -EINVAL; + bin->valid_data_addr =3D AW96103_BIN_VALID_DATA_OFFSET; - bin->valid_data_len =3D - *(unsigned int *)(bin->data + AW96103_BIN_DATA_LEN_OFFSET) - - AW96103_BIN_DATA_REG_NUM_SIZE; memcpy(bin->chip_type, bin->data + AW96103_BIN_CHIP_TYPE_OFFSET, AW96103_BIN_CHIP_TYPE_SIZE); + + return 0; } =20 static const struct regmap_config aw96103_regmap_confg =3D { @@ -500,7 +514,7 @@ static int aw96103_bin_valid_loaded(struct aw96103 *aw9= 6103, int ret; =20 for (i =3D 0; i < aw_bin_data_s->valid_data_len; - i +=3D 6, start_addr +=3D 6) { + i +=3D AW96103_BIN_REG_SIZE, start_addr +=3D AW96103_BIN_REG_SIZE) { reg_addr =3D get_unaligned_le16(aw_bin_data_s->data + start_addr); reg_data =3D get_unaligned_le32(aw_bin_data_s->data + start_addr + 2); @@ -550,6 +564,8 @@ static int aw96103_para_loaded(struct aw96103 *aw96103) static int aw96103_cfg_all_loaded(const struct firmware *cont, struct aw96103 *aw96103) { + int ret; + if (!cont) return -EINVAL; =20 @@ -561,7 +577,9 @@ static int aw96103_cfg_all_loaded(const struct firmware= *cont, aw_bin->len =3D cont->size; memcpy(aw_bin->data, cont->data, cont->size); release_firmware(cont); - aw96103_parsing_bin_file(aw_bin); + ret =3D aw96103_parsing_bin_file(aw_bin); + if (ret) + return ret; =20 return aw96103_bin_valid_loaded(aw96103, aw_bin); } --=20 2.51.2