Re: [PATCH v3] iio: proximity: hx9023s: validate firmware size

[Andy Shevchenko]

On Mon, Jul 13, 2026 at 10:31:30AM +0545, Laxman Acharya Padhya wrote:
> hx9023s_send_cfg() copies the firmware into a counted flexible array and
> then reads fixed offsets from the copied data before walking register/value
> pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore
> make the driver read past the copied buffer during probe-time configuration
> loading.
> 
> Reject firmware images that cannot contain the fixed header, reject images
> too large for the u16 fw_size field, and validate that the advertised
> register count fits in the remaining payload.

> Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file
> parsing functionality")

This has to be a single line.

> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>

...

> v3:
> - Resend once in plain-text format after the duplicate v2 messages.
> - Keep each commit trailer on one complete line.

None of these is being addressed.

...

>  static int hx9023s_send_cfg(const struct firmware *fw, struct
> hx9023s_data *data)
>  {
> + /* fw_size is u16 in struct hx9023s_bin, so reject truncation. */
> + if (fw->size < FW_DATA_OFFSET || fw->size > U16_MAX)
> + return -EINVAL;

The patch is mangled. Please, conduct an investigation before sending any new
versions or other patches to the kernel mailing lists.

>   struct hx9023s_bin *bin __free(kfree) =
>    kzalloc(fw->size + sizeof(*bin), GFP_KERNEL);
>   if (!bin)

Compare the above to

	struct hx9023s_bin *bin __free(kfree) =
		kzalloc(fw->size + sizeof(*bin), GFP_KERNEL);
	if (!bin)
		return -ENOMEM;

	bin->fw_size = fw->size;
	memcpy(bin->data, fw->data, bin->fw_size);

-- 
With Best Regards,
Andy Shevchenko