From a5367912ba81dfb3180fce89b545b009e57f17a5 Mon Sep 17 00:00:00 2001 From: Sreeraj S Kurup Date: Sat, 25 Jul 2026 15:52:55 +0000 Subject: [PATCH] firewire: core: validate sub-block lengths in fw_core_add_descriptor() When traversing internal block structures of a descriptor in fw_core_add_descriptor(), each sub-block header specifies its own length in the upper 16 bits of its header quadlet. If a malformed or corrupted descriptor provides a sub-block length that exceeds the remaining total length of the descriptor buffer, the parsing loop advances past the allocated boundary of desc->data, leading to an out-of-bounds read access. Validate each sub-block's length against the remaining descriptor size before advancing the offset pointer to ensure loop bounds safety. Signed-off-by: Sreeraj S Kurup Link: https://lore.kernel.org/r/20260725155255.3054-3-sreekuttan2156239@gmail.com Signed-off-by: Takashi Sakamoto --- drivers/firewire/core-card.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c index eaec54ea287a..94992791f02e 100644 --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -173,9 +173,25 @@ int fw_core_add_descriptor(struct fw_descriptor *desc) return -EINVAL; i = 0; - while (i < desc->length) - i += (desc->data[i] >> 16) + 1; + /* + * Validate internal block structures within the descriptor. Each sub-block + * encodes its length in the top 16 bits of its header quadlet. + */ + while (i < desc->length) { + u16 block_len = desc->data[i] >> 16; + /* + * Guard against corrupted descriptors where an individual block length + * claims to extend past the allocated end of desc->data, avoiding + * out-of-bounds reads. + */ + if (block_len >= desc->length - i) + return -EINVAL; + + i += block_len + 1; + } + + /* The sum of sub-block lengths must match total descriptor length */ if (i != desc->length) return -EINVAL;