Re: [PATCH v3 0/2] firewire: core: validate descriptor and sub-block lengths in fw_core_add_descriptor()

[Takashi Sakamoto]

Hi,

On Sat, Jul 25, 2026 at 03:52:53PM +0000, Sreeraj S Kurup wrote:
> This two-patch series addresses potential out-of-bounds memory
> accesses when parsing Config ROM descriptors in
> fw_core_add_descriptor().
> 
> Patch 1 adds overall length validation using the in_range() macro
> to ensure descriptors fit within standard IEEE 1394 Config ROM
> limits (256 quadlets).
> 
> Patch 2 validates individual sub-block header lengths during
> iteration to prevent reading past allocated buffer boundaries on
> malformed inputs.
> 
> v2 -> v3:
>  - Split original single patch into two distinct commits for cleaner
>    review as requested by Takashi Sakamoto.
>  - Simplified overall length check using the in_range() macro.
> 
> Sreeraj S Kurup (2):
>   firewire: core: validate overall descriptor length in
>     fw_core_add_descriptor()
>   firewire: core: validate sub-block lengths in fw_core_add_descriptor()
> 
>  drivers/firewire/core-card.c | 28 ++++++++++++++++++++++------
>  1 file changed, 22 insertions(+), 6 deletions(-)

Applied to for-next branch.

By the way, how do you think about the following change in your previous
patches? It seems to be omitted from current patchset.

======== 8< --------
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index a754c6366b97..cb8ce491fe9d 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -143,7 +143,11 @@ static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 	for (i = 0; i < j; i += length + 1)
 		length = fw_compute_block_crc(config_rom + i);

-	WARN_ON(j != config_rom_length);
+     if (j != config_rom_length) {
+        pr_warn("FireWire ROM length mismatch: expected %zu, got %d\n",
+            config_rom_length, j);
+        config_rom_length = j;
+     }
 }
======== 8< --------


Thanks

Takashi Sakamoto