From nobody Tue Sep 29 00:33:34 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD69A421239; Fri, 14 Aug 2026 08:09:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786694963; cv=none; b=dEU7PQR2b1UrG0mjKYXiMs+ZYFakxOXQGGJMtLtrZyhU/MhW1WFg0xSBMEvEaRbTDWyziYdGeskv/fpqD7nTyeJspMw4cRpl6ZHL420/SHtf8PATiRKKNPH+63jaa6q98m2p+Tc68faGJPaNZHC6mATAQn/DN2AyMwpebAFDumI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786694963; c=relaxed/simple; bh=okwL7ZJplb/sP/nkMXhC6y/oR8+Vkv22Spo11h4TLJo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Qd4i3vOwEUA5pM4d/HMNofMSEnH3VcAM+L9/tI/haqOmh8ZdJ2+TCF9K/4OJYwTZLGRjCEezOjaEEZpsEm2IrHsTDemah1kCMOPQyz7VFJ8ooosYRKoEKCWg91n4uUbgK+RPkxsxUvcXOiR5PClZEeTEE/cqD8c0oXWze+XXlFs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowABXK+8tzX5qRv2eBQ--.62772S2; Fri, 14 Aug 2026 16:09:18 +0800 (CST) From: Pengpeng Hou To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2] media: require two-byte Cypress type 04 records Date: Fri, 14 Aug 2026 16:08:02 +0800 Message-ID: <20260814080802.24018-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowABXK+8tzX5qRv2eBQ--.62772S2 X-Coremail-Antispam: 1UD129KBjvJXoW7Cr1kJFy3ZryrJF45Ww1xXwb_yoW8tF4fpa y0gF4IkFWkGrWSq3y7Jw13uFWrWws3W3y5Gr9rA3ZYvF4fCa4DCry8Ka4jgr15Jr1fAasr KFs0qr93GFy5JF7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUyK14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26ryj6F1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVWxJr0_GcWl84ACjcxK6I8E87Iv6xkF7I0E14v26r xl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r1q6rW5McIj6I8E87Iv67AKxVW8JVWxJwAm72CE4IkC6x0Yz7v_Jr 0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7MxAIw28IcxkI7VAK I48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7 xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xII jxv20xvE14v26r4j6ryUMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWxJVW8Jr1lIxAIcVCF04 k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r4j6F4UMIIF0xvEx4A2jsIEc7Cj xVAFwI0_Gr1j6F4UJbIYCTnIWIevJa73UjIFyTuYvjfU0pBTUUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Both Cypress Intel HEX parsers read two address bytes from type 04 records. Generic record framing permits any record length, so a short record can make the parser consume the checksum or bytes beyond the firmware record. A longer record also violates the Intel HEX type 04 layout. Require the type 04 payload length to be exactly two bytes in both implementations. Fixes: 79a63c60a6a2 ("[media] media: move dvb-usb-v2/cypress_firmware.c to = media/common") Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- Changes since v1: https://lore.kernel.org/all/20260715084129.36795-1-pengpe= ng@iscas.ac.cn/ - enforce the Intel HEX type 04 exact two-byte payload contract - apply the same contract to both independent Cypress parsers The Intel HEX record contract was reviewed statically; malformed firmware was not injected into either Cypress loader. drivers/media/common/cypress_firmware.c | 2 ++ drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/drivers/media/common/cypress_firmware.c b/drivers/media/common= /cypress_firmware.c index 66274fdf5243..d0f66ed01c4b 100644 --- a/drivers/media/common/cypress_firmware.c +++ b/drivers/media/common/cypress_firmware.c @@ -59,6 +59,8 @@ static int cypress_get_hexline(const struct firmware *fw, if (hx->type =3D=3D 0x04) { /* b[4] and b[5] are the Extended linear address record data * field */ + if (hx->len !=3D 2) + return -EINVAL; hx->addr |=3D (b[4] << 24) | (b[5] << 16); } =20 diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/u= sb/dvb-usb/dvb-usb-firmware.c index 0fb3fa6100e4..675d9d1d4f47 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c @@ -141,6 +141,8 @@ int dvb_usb_get_hexline(const struct firmware *fw, stru= ct hexline *hx, =20 if (hx->type =3D=3D 0x04) { /* b[4] and b[5] are the Extended linear address record data field */ + if (hx->len !=3D 2) + return -EINVAL; hx->addr |=3D (b[4] << 24) | (b[5] << 16); /* hx->len -=3D 2; data_offs +=3D 2; */ --=20 2.50.1 (Apple Git-155)