[PATCH] ASoC: max98390: Fix potential crash during param fw loading

[Steve Lee]

> -----Original Message-----
> From: Mark Brown <broonie at kernel.org>
> Sent: Wednesday, June 3, 2020 8:32 PM
> To: Steve Lee <SteveS.Lee at maximintegrated.com>
> Cc: lgirdwood at gmail.com; perex at perex.cz; tiwai at suse.com;
> ckeepax at opensource.cirrus.com; geert at linux-m68k.org;
> rf at opensource.wolfsonmicro.com; shumingf at realtek.com;
> srinivas.kandagatla at linaro.org; krzk at kernel.org; dmurphy at ti.com;
> jack.yu at realtek.com; nuno.sa at analog.com; linux-kernel at vger.kernel.org;
> alsa-devel at alsa-project.org; ryan.lee.maxim at gmail.com; Ryan Lee
> <RyanS.Lee at maximintegrated.com>; steves.lee.maxim at gmail.com
> Subject: Re: [PATCH] ASoC: max98390: Fix potential crash during param fw
> loading
> 
> On Wed, Jun 03, 2020 at 08:18:19PM +0900, Steve Lee wrote:
> 
> > +	param_start_addr = (dsm_param[0] & 0xff) | (dsm_param[1] & 0xff) <<
> 8;
> > +	param_size = (dsm_param[2] & 0xff) | (dsm_param[3] & 0xff) << 8;
> > +	if (param_size > MAX98390_DSM_PARAM_MAX_SIZE ||
> > +		param_start_addr < DSM_STBASS_HPF_B0_BYTE0) {
> > +		dev_err(component->dev,
> > +			"param fw is invalid.\n");
> > +		goto err_alloc;
> > +	}
> 
> This is now reading the size out of the header of the file which is good but it
> should also validate that the file is big enough to have this much data in it,
> otherwise it's possible to read beyond the end of the firmware file (eg, if it got
> truncated somehow).  Previously the code used the size of the file read from disk
> so that wasn't an issue.

 Thanks for quick comment. Can this case cover by below line?
+	if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
+		dev_err(component->dev,
+			"param fw is invalid.\n");
+		goto err_alloc;
+	}