github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

USB: serial: mxuport: validate firmware header size

Browse Source 
mxuport_probe() reads version bytes at fixed offsets after
request_firmware() succeeds. Firmware loading success does not prove that
the blob reaches the highest version offset.

Reject short firmware images before reading the version bytes. This is
source-level parser hardening; no affected device or crash was observed.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Fixes: ee467a1f20 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
Pengpeng Hou 2026-07-20 19:52:20 +08:00 committed by Johan Hovold
parent fad0fd120e
commit 52beeed5e5
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/usb/serial/mxuport.c
View File

@ -1080,6 +1080,13 @@ static int mxuport_probe(struct usb_serial *serial,
/* Use the firmware already in the device */
err = 0;
} else {
if (fw_p->size <= VER_ADDR_3) {
dev_err(&serial->interface->dev,
"Firmware %s is too short\n", buf);
err = -EINVAL;
goto out;
}
local_ver = ((fw_p->data[VER_ADDR_1] << 16) |
(fw_p->data[VER_ADDR_2] << 8) |
fw_p->data[VER_ADDR_3]);