Skip to contentSkip to conversation

Patch "ASoC: wm_adsp: Fix validation of firmware and coeff lengths" has been added to the 4.14-stable tree

PATCH [email protected] 1 participant 1 message Dec 30, 2017

Subsystems (4)
Stable branch Sound ASoC Wolfson microelectronics drivers
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ASoC: wm_adsp: Fix validation of firmware and coeff lengths

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
asoc-wm_adsp-fix-validation-of-firmware-and-coeff-lengths.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 Mon Sep 17 00:00:00 2001

From: Ben Hutchings <[email protected]>
Date: Fri, 8 Dec 2017 16:15:20 +0000
Subject: ASoC: wm_adsp: Fix validation of firmware and coeff lengths

From: Ben Hutchings <[email protected]>

commit 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 upstream.

The checks for whether another region/block header could be present are subtracting the size from the current offset. Obviously we should instead subtract the offset from the size.

The checks for whether the region/block data fit in the file are adding the data size to the current offset and header size, without checking for integer overflow. Rearrange these so that overflow is impossible.

Signed-off-by Ben Hutchings <[email protected]>
Acked-by Charles Keepax <[email protected]>
Tested-by Charles Keepax <[email protected]>
Signed-off-by Mark Brown <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 sound/soc/codecs/wm_adsp.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
sound/soc/codecs/wm_adsp.c +6 -6
@@ -1733,7 +1733,7 @@ static int wm_adsp_load(struct wm_adsp *
 		 le64_to_cpu(footer->timestamp));
 
 	while (pos < firmware->size &&
-	       pos - firmware->size > sizeof(*region)) {
+	       sizeof(*region) < firmware->size - pos) {
 		region = (void *)&(firmware->data[pos]);
 		region_name = "Unknown";
 		reg = 0;

@@ -1782,8 +1782,8 @@ static int wm_adsp_load(struct wm_adsp *
 			 regions, le32_to_cpu(region->len), offset,
 			 region_name);
 
-		if ((pos + le32_to_cpu(region->len) + sizeof(*region)) >
-		    firmware->size) {
+		if (le32_to_cpu(region->len) >
+		    firmware->size - pos - sizeof(*region)) {
 			adsp_err(dsp,
 				 "%s.%d: %s region len %d bytes exceeds file length %zu\n",
 				 file, regions, region_name,

@@ -2253,7 +2253,7 @@ static int wm_adsp_load_coeff(struct wm_
 
 	blocks = 0;
 	while (pos < firmware->size &&
-	       pos - firmware->size > sizeof(*blk)) {
+	       sizeof(*blk) < firmware->size - pos) {
 		blk = (void *)(&firmware->data[pos]);
 
 		type = le16_to_cpu(blk->type);

@@ -2327,8 +2327,8 @@ static int wm_adsp_load_coeff(struct wm_
 		}
 
 		if (reg) {
-			if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) >
-			    firmware->size) {
+			if (le32_to_cpu(blk->len) >
+			    firmware->size - pos - sizeof(*blk)) {
 				adsp_err(dsp,
 					 "%s.%d: %s region len %d bytes exceeds file length %zu\n",
 					 file, blocks, region_name,

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/asoc-wm_adsp-fix-validation-of-firmware-and-coeff-lengths.patch