From nobody Sat Jul 25 22:34:25 2026 Received: from mail-vs1-f45.google.com (mail-vs1-f45.google.com [209.85.217.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9EC233F58D for ; Mon, 13 Jul 2026 04:46:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.217.45 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783918004; cv=pass; b=NnORkParwLMKvtrsEd0JhPZqHQ0EGvgMkM41+iSS+yo89Jh2adr1a4A0WwK6m9JJYdUm9evjTNSdkp8PiaJk3FBwHWLsDPtPQ5KM1ZNmS+z6migXhr0+mQilpOETDZ7Zw37La8epbMPMP9Rx5FO4Vyj0OXGhxe1kty3w9S3J87Y= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783918004; c=relaxed/simple; bh=fvnrMic/Wc1PqTxLDwgJWHRDgytppByxvectU/n/IUw=; h=MIME-Version:From:Date:Message-ID:Subject:To:Cc:Content-Type; b=P0qsP32SVOmUWvN5Z3qnR4pR7qcEyhrKzqKryaN0PqoDV/fOFEPRffVlhYdM6AwAUCfbPiwpuXcLDMyncwJ65m22iCx+3XpsAQbu8C5MTYM0DiLgALYnoNnfWzjNJn8847ezO5Q7Kr+XepmgzHUbqm9hlJ5UDZmCUdlNZTxLk8Q= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VKWawFVM; arc=pass smtp.client-ip=209.85.217.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VKWawFVM" Received: by mail-vs1-f45.google.com with SMTP id ada2fe7eead31-7348dc69800so1199807137.0 for ; Sun, 12 Jul 2026 21:46:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783918002; cv=none; d=google.com; s=arc-20260327; b=KTOhp64byp5g3Xw5DCkWTQ8z4JArMOzGHJ3Nas9T5AKHuINvylu6WeM3vrQq9iDRaN jWbHDGUoyuxcu9kxaz7BZQsqfGjZHQ5TS1v14W3Gvnq4niMnQNOsG9C+BG9QiaM/A0bt 2idLgeQjwaOWU1ugxSrucv8KZrEla842CNDdpb4xudsW2KnJAS7MsxVJ4jsOeqBINjCA t8TYqgN0Zvs1gOW3nsZoocJ1vb/O9UeItZ7VetZu1TrzGbyKw6j8SrHf5ERvLSDXD+cM ds584vwAbV4RM51OOR19QxcBkhzzoJL+a3G5Eyn6gyu7bKZL8FqaiFZdlB971Ew/W2V7 N25w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=tIvuNpwtX62wjAACnY5xLsw8rSHDkSGnso4sTTSlICc=; fh=14aJxRq0YlCcQzkUk0Xz6oQAE/eTvQpPXWTOwtLKW8w=; b=rlNKZajs4N400bNnEWit26tJQFlVr1SOsAzqG1S7xuatvQnMGFSq904NQ62VxKJDb9 7+nBO/Ji+S/EdwvMmB35SQHiXUZ7oBHQalfBESrKhpH9C0TjCKgQ3Xe+VCTuzIlrcaMV v/GCbNtVPofOwnBcPGh8ekXACeCBgDClEjQujW79fiys5XklUm5II2bLlR3DJUkcd44y 3G4iqDikJzgZOnUAfmRCDn/7+XXQs7GnG7QdlIpzVD7ihhZsAI6HrcXsH7+wtH/MqoEX Ut6vuWdCsxpDwf6V1ivqgPaFup7L8d/f4OUkoc+QzLZZqT7XW+UyWuhjGHWymLC/QW4M 7hbA==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783918002; x=1784522802; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=tIvuNpwtX62wjAACnY5xLsw8rSHDkSGnso4sTTSlICc=; b=VKWawFVM5BIeOP3qLxypfVpetO2xJCBjiyZOScJ3m9zueCZYvL/HzWQC4khGdhLrS3 yFgY33Jx57nSaWF+0HHM5Ek9iVXbw95lyKPPpqRWzG+uejQBC8oRuPdPXo1ydet+rTci JxicKhagF8E11EOFeT+7FB43gJy2YwiNpuu7kjpL21hBC4kU6PRixnwofRNqe08+4RfO m7t2VzK/Btn5bWDlKB7B5wlMx/gLPwKrS5LboH0zUCLvaJOS1ZU9IXH5cgAjllyue0nG jb8O1QkEiyTF4mmSpAHjzSMKwYyY6QlA8Oh2atcv9q/WUeOnKKcaFNgvwncFDanWw3eJ Wmfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783918002; x=1784522802; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=tIvuNpwtX62wjAACnY5xLsw8rSHDkSGnso4sTTSlICc=; b=SAQpprKIxhlUNu+cjG1VXmWvJFzVi2QMS9yivnq2fRTafE6MMXPK60o0lROlJcZ3u5 Q87/Nz1dggVSgKJ7Xuzj2IpZ01eSN4tu7PTRIMg34Vc5KzQIk30UcOsfBjGNmi9XbaAg iWzS5Ea4uDMaZVZOhy5qjLkoOhHNWPJJayfuPrDHUSP+tLQAqtPeR3mK66L1piisz8e6 8AFWUayM3XINH0/DrztePLCdfyDIVdu1BrOm06yUm7au9hY4BXLoSKHguBWBfc/Es78l Y67UaYZh4cnSQ3N0/6qf7Bu+8glLaSSCSX+KCA6RAUm+eJD0hFDni6/eWqlQlgcbdTND EiAg== X-Forwarded-Encrypted: i=1; AHgh+RoFpyBIruFxrFPSrZmYNBbY1JwIshbqCTNeJrMy0Yq9399Xk+HJEuxKLK5wuowu5tQNrAiniHzljWDFwsw=@vger.kernel.org X-Gm-Message-State: AOJu0Yx/A77znMng/VlnPXCr4oBM+e8WQXJ6QcM5/r21JVaQu/QFFXV4 JjyChSDD5A0H1fdJ9ZDgmUEuHAvMd8pYuFZa644DpaoGVC4TcyE4STEy6g/CbZGhd7sQaP3NdCK zgcu/8KShZSkUKet87NduqYtPiaY3AO8= X-Gm-Gg: AfdE7cns9QH5sBmJrbb6WtZvUr+CRS99QTtbQ4MHgckLeefPproHsi83Y0kL/8D66RS Ow7GWG6eZGYNG97CHuJy64RYsYbj+JtNgK6VRIgyFDJyg4TqUNiCdUR8wbDA2Y8BlZe+QD/lKXe H9xJ4HIFTV2BbCoVwH5xiJ2kjEoNPWSETH6/D49KZLkWD2Rh7TiaDAESAQ4yBxZ6e8rSb58BmNi S1RfJL/Kx4ztfRgnfoG2XymReHkszqRp1YjzwlDscx8UPiwzoRgNeiO7jTKt+dnkxmVKgaWXbvA ln6/kH1ZSXUQQt610TYQ+/0/snlXHqm0kj0LxsLww4jD1dEUFFkCBbfAOElh8ZC4NwHbuO+t/jF U8jSql6NsO/k= X-Received: by 2002:a05:6102:3ca3:b0:737:80f0:7887 with SMTP id ada2fe7eead31-74533bbbd15mr4116564137.8.1783918001726; Sun, 12 Jul 2026 21:46:41 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Laxman Acharya Padhya Date: Mon, 13 Jul 2026 10:31:30 +0545 X-Gm-Features: AUfX_mwwEselmh9IRE3VEYEs8ZRe2pmlXbwSM1DlLxUaasQrg06o4Yn065i_PUU Message-ID: Subject: [PATCH v3] iio: proximity: hx9023s: validate firmware size To: Jonathan Cameron Cc: David Lechner , =?UTF-8?B?TnVubyBTw6E=?= , Andy Shevchenko , Joshua Crofts , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hx9023s_send_cfg() copies the firmware into a counted flexible array and then reads fixed offsets from the copied data before walking register/value pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore make the driver read past the copied buffer during probe-time configuration loading. Reject firmware images that cannot contain the fixed header, reject images too large for the u16 fw_size field, and validate that the advertised register count fits in the remaining payload. Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality") Cc: stable@vger.kernel.org Reviewed-by: Joshua Crofts Signed-off-by: Laxman Acharya Padhya --- v3: - Resend once in plain-text format after the duplicate v2 messages. - Keep each commit trailer on one complete line. --- drivers/iio/proximity/hx9023s.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023= s.c index a6ff7cbe9e65..685053b84b34 100644 --- a/drivers/iio/proximity/hx9023s.c +++ b/drivers/iio/proximity/hx9023s.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -1031,6 +1032,10 @@ static int hx9023s_bin_load(struct hx9023s_data *data, struct hx9023s_bin *bin) static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data) { + /* fw_size is u16 in struct hx9023s_bin, so reject truncation. */ + if (fw->size < FW_DATA_OFFSET || fw->size > U16_MAX) + return -EINVAL; + struct hx9023s_bin *bin __free(kfree) =3D kzalloc(fw->size + sizeof(*bin), GFP_KERNEL); if (!bin) @@ -1041,7 +1046,8 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data bin->fw_ver =3D bin->data[FW_VER_OFFSET]; bin->reg_count =3D get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET); - release_firmware(fw); + if (bin->reg_count > (bin->fw_size - FW_DATA_OFFSET) / 2) + return -EINVAL; return hx9023s_bin_load(data, bin); } @@ -1058,6 +1064,7 @@ static void hx9023s_cfg_update(const struct firmware *fw, void *context) } ret =3D hx9023s_send_cfg(fw, data); + release_firmware(fw); if (ret) { dev_warn(dev, "Firmware update failed: %d\n", ret); goto no_fw; --=20 2.51.2