From e8e659f79178c3c30bbfbfac7a310a2a27c9694b Mon Sep 17 00:00:00 2001 From: Sreeraj S Kurup Date: Sat, 25 Jul 2026 15:52:54 +0000 Subject: [PATCH] firewire: core: validate overall descriptor length in fw_core_add_descriptor() In fw_core_add_descriptor(), incoming descriptor structures are processed without checking whether the descriptor's specified length falls within valid boundaries. An empty descriptor (length 0) or an oversized descriptor exceeding the IEEE 1394 Config ROM capacity can lead to invalid processing. Add bounds checking at the start of fw_core_add_descriptor() using the in_range() helper macro to reject descriptors with length 0 or length exceeding 256 quadlets (the standard maximum Configuration ROM size). Signed-off-by: Sreeraj S Kurup Link: https://lore.kernel.org/r/20260725155255.3054-2-sreekuttan2156239@gmail.com Signed-off-by: Takashi Sakamoto --- drivers/firewire/core-card.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c index a754c6366b97..eaec54ea287a 100644 --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include @@ -167,11 +168,10 @@ int fw_core_add_descriptor(struct fw_descriptor *desc) { size_t i; - /* - * Check descriptor is valid; the length of all blocks in the - * descriptor has to add up to exactly the length of the - * block. - */ + /* Reject empty descriptors or those exceeding max Config ROM size (256 quadlets) */ + if (!in_range(desc->length, 1, 256)) + return -EINVAL; + i = 0; while (i < desc->length) i += (desc->data[i] >> 16) + 1;