[greybus-dev] Re: [PATCH] greybus: audio: bound the topology section sizes against the fetched size

On Tue, Jun 16, 2026 at 12:01:30PM +0530, Greg Kroah-Hartman wrote:

On Tue, Jun 16, 2026 at 01:06:12AM -0500, Bryam Vargas via B4 Relay wrote:

...

---

drivers/staging/greybus/audio_gb.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)

diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c index 9d8994fdb41a..144591f1a512 100644 --- a/drivers/staging/greybus/audio_gb.c +++ b/drivers/staging/greybus/audio_gb.c @@ -37,6 +37,19 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, return ret; }

• /*

• * The size_* fields are supplied by the module and are used by
  

• * gbaudio_tplg_parse_data() to compute offsets into the blob; make
  

• * sure the sections fit within the fetched topology, so walking it
  

• * cannot read out of bounds.
  

• */
  

• if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) +

•    le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) >
  

•    size - sizeof(*topo)) {
  

Are you sure these checks will not overflow?

Yep. The cast to u64 ensures that.

regards, dan carpenter