RE: [PATCH] ASoC: max98390: Fix potential crash during param fw loading

[Steve Lee]

> -----Original Message-----
> From: Mark Brown <broonie@xxxxxxxxxx>
> Sent: Wednesday, June 3, 2020 8:43 PM
> To: Steve Lee <SteveS.Lee@xxxxxxxxxxxxxxxxxxx>
> Cc: lgirdwood@xxxxxxxxx; perex@xxxxxxxx; tiwai@xxxxxxxx;
> ckeepax@xxxxxxxxxxxxxxxxxxxxx; geert@xxxxxxxxxxxxxx;
> rf@xxxxxxxxxxxxxxxxxxxxxxxxxxx; shumingf@xxxxxxxxxxx;
> srinivas.kandagatla@xxxxxxxxxx; krzk@xxxxxxxxxx; dmurphy@xxxxxx;
> jack.yu@xxxxxxxxxxx; nuno.sa@xxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx;
> alsa-devel@xxxxxxxxxxxxxxxx; ryan.lee.maxim@xxxxxxxxx; Ryan Lee
> <RyanS.Lee@xxxxxxxxxxxxxxxxxxx>; steves.lee.maxim@xxxxxxxxx
> Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw
> loading
> 
> On Wed, Jun 03, 2020 at 11:37:44AM +0000, Steve Lee wrote:
> 
> > > This is now reading the size out of the header of the file which is
> > > good but it should also validate that the file is big enough to have
> > > this much data in it, otherwise it's possible to read beyond the end
> > > of the firmware file (eg, if it got truncated somehow).  Previously
> > > the code used the size of the file read from disk so that wasn't an issue.
> 
> >  Thanks for quick comment. Can this case cover by below line?
> > +	if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
> > +		dev_err(component->dev,
> > +			"param fw is invalid.\n");
> > +		goto err_alloc;
> > +	}
> 
> No, that doesn't cover all of it - the case I'm concerned about is the case where
> we've got enough data for the header but the payload is truncated.  You need a
> check that param_size + _PAYLOAD_OFFSET is less than fw->size as well.

  Yes, I will update this and good enough.