Re: [PATCH v3 0/2] firewire: core: validate descriptor and sub-block lengths in fw_core_add_descriptor()

[Takashi Sakamoto]

Hi,

On Mon, Jul 27, 2026 at 05:42:31PM +0000, Sreeraj S Kurup wrote:
> Hi Takashi,
> 
> Thanks for applying the series to the for-next branch!
> 
> Regarding the change in generate_config_rom():
> 
> I dropped that specific change from this patchset to keep the series 
> strictly focused on the out-of-bounds issue in fw_core_add_descriptor(). 
> 
> `WARN_ON(j != config_rom_length)` acts as an assertion that the ROM block 
> traversal matched the expected length. Replacing it with pr_warn() and 
> clamping `config_rom_length = j` avoids a kernel warning splat, but if 
> j != config_rom_length occurs, it indicates an unexpected state during 
> ROM generation rather than a standard runtime condition.
> 
> If you feel handling length mismatches gracefully via pr_warn() and updating 
> config_rom_length is preferred over the WARN_ON assertion, I would be happy 
> to send a follow-up patch for it.

Hm. The case that j does not equals to config_rom_length seems to be a
programming mistake and should be fixed immediately. So let me leave it
as is without any mitigation.


Thanks

Takashi Sakamoto