github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

USB: serial: io_ti: reject oversized boot-mode firmware

Browse Source 
do_boot_mode() copies the firmware payload, excluding its four-byte prefix,
into a fixed 15.5 KiB staging buffer. check_fw_sanity() already proves that
the image contains its seven-byte header and validates the declared image
length and checksum, but it does not impose this boot-mode destination
limit.

Reject images whose payload does not fit before allocating and filling the
staging buffer.

Fixes: d12b219a22 ("edgeport-ti: use request_firmware()")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
Pengpeng Hou 2026-07-20 19:48:17 +08:00 committed by Johan Hovold
parent 52beeed5e5
commit 6fcd91ce2a
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/usb/serial/io_ti.c
View File

@ -1464,6 +1464,12 @@ static int do_boot_mode(struct edgeport_serial *serial,
/* Allocate a 15.5k buffer + 3 byte header */
buffer_size = (((1024 * 16) - 512) +
sizeof(struct ti_i2c_image_header));
if (fw->size - 4 > buffer_size) {
dev_err(dev, "%s - firmware image is too large\n",
__func__);
return -EINVAL;
}
buffer = kmalloc(buffer_size, GFP_KERNEL);
if (!buffer)
return -ENOMEM;