diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-20 19:48:17 +0800 |
|---|---|---|
| committer | Johan Hovold <johan@kernel.org> | 2026-07-20 16:35:40 +0200 |
| commit | 6fcd91ce2a0787cd4bdf6a0b3cd4884566a3cdba (patch) | |
| tree | 71bd3696857bcd99198f90f84a94ab491439d24d /drivers/usb/serial | |
| parent | 52beeed5e5d257e1da3e2d2f2fb25bc1e3cdb6d2 (diff) | |
| download | linux-next-6fcd91ce2a0787cd4bdf6a0b3cd4884566a3cdba.tar.gz linux-next-6fcd91ce2a0787cd4bdf6a0b3cd4884566a3cdba.zip | |
USB: serial: io_ti: reject oversized boot-mode firmware
do_boot_mode() copies the firmware payload, excluding its four-byte prefix,
into a fixed 15.5 KiB staging buffer. check_fw_sanity() already proves that
the image contains its seven-byte header and validates the declared image
length and checksum, but it does not impose this boot-mode destination
limit.
Reject images whose payload does not fit before allocating and filling the
staging buffer.
Fixes: d12b219a228e ("edgeport-ti: use request_firmware()")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
Diffstat (limited to 'drivers/usb/serial')
| -rw-r--r-- | drivers/usb/serial/io_ti.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c index 07c0eff3bef4..cc28f5869a3e 100644 --- a/drivers/usb/serial/io_ti.c +++ b/drivers/usb/serial/io_ti.c @@ -1464,6 +1464,12 @@ static int do_boot_mode(struct edgeport_serial *serial, /* Allocate a 15.5k buffer + 3 byte header */ buffer_size = (((1024 * 16) - 512) + sizeof(struct ti_i2c_image_header)); + if (fw->size - 4 > buffer_size) { + dev_err(dev, "%s - firmware image is too large\n", + __func__); + return -EINVAL; + } + buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) return -ENOMEM; |