github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

firewire: core: validate overall descriptor length in fw_core_add_descriptor()

Browse Source 
In fw_core_add_descriptor(), incoming descriptor structures are processed
without checking whether the descriptor's specified length falls within
valid boundaries. An empty descriptor (length 0) or an oversized descriptor
exceeding the IEEE 1394 Config ROM capacity can lead to invalid processing.

Add bounds checking at the start of fw_core_add_descriptor() using the
in_range() helper macro to reject descriptors with length 0 or length
exceeding 256 quadlets (the standard maximum Configuration ROM size).

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
Link: https://lore.kernel.org/r/20260725155255.3054-2-sreekuttan2156239@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
This commit is contained in:
Sreeraj S Kurup 2026-07-25 15:52:54 +00:00 committed by Takashi Sakamoto
parent f5098b6bae
commit e8e659f791
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/firewire/core-card.c
View File

@ -16,6 +16,7 @@
#include <linux/list.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/minmax.h>
#include <linux/spinlock.h>
#include <linux/workqueue.h>
@ -167,11 +168,10 @@ int fw_core_add_descriptor(struct fw_descriptor *desc)
{
size_t i;
/*
* Check descriptor is valid; the length of all blocks in the
* descriptor has to add up to exactly the length of the
* block.
*/
/* Reject empty descriptors or those exceeding max Config ROM size (256 quadlets) */
if (!in_range(desc->length, 1, 256))
return -EINVAL;
i = 0;
while (i < desc->length)
i += (desc->data[i] >> 16) + 1;