Re: [PATCH v3] iio: proximity: hx9023s: validate firmware size

[Joshua Crofts]

On Mon, 13 Jul 2026 14:34:32 +0300
Andy Shevchenko <andriy.shevchenko@xxxxxxxxx> wrote:

> On Mon, Jul 13, 2026 at 10:31:30AM +0545, Laxman Acharya Padhya wrote:
> > hx9023s_send_cfg() copies the firmware into a counted flexible array and
> > then reads fixed offsets from the copied data before walking register/value
> > pairs starting at FW_DATA_OFFSET. A truncated firmware image can therefore
> > make the driver read past the copied buffer during probe-time configuration
> > loading.
> > 
> > Reject firmware images that cannot contain the fixed header, reject images
> > too large for the u16 fw_size field, and validate that the advertised
> > register count fits in the remaining payload.  
> 
> > Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file
> > parsing functionality")  
> 
> This has to be a single line.
> 
> > Cc: stable@xxxxxxxxxxxxxxx
> > Reviewed-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>

Remove my tag for the time being, I do agree with the change in principle
however this patch needs a bit more work than I expected. Happy to re-review
once everyone's comments have been addressed.

-- 
Kind regards

CJD