diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-20 19:52:20 +0800 |
|---|---|---|
| committer | Johan Hovold <johan@kernel.org> | 2026-07-20 16:24:04 +0200 |
| commit | 52beeed5e5d257e1da3e2d2f2fb25bc1e3cdb6d2 (patch) | |
| tree | 33e56d9d976d1ff9685cd6a3ff9119ab188d892a | |
| parent | fad0fd120e29041b3e6cdf41bb12e3184fb524a2 (diff) | |
USB: serial: mxuport: validate firmware header size
mxuport_probe() reads version bytes at fixed offsets after
request_firmware() succeeds. Firmware loading success does not prove that
the blob reaches the highest version offset.
Reject short firmware images before reading the version bytes. This is
source-level parser hardening; no affected device or crash was observed.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
| -rw-r--r-- | drivers/usb/serial/mxuport.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c index e3c5a1b97542..088d5dd8abb5 100644 --- a/drivers/usb/serial/mxuport.c +++ b/drivers/usb/serial/mxuport.c @@ -1080,6 +1080,13 @@ static int mxuport_probe(struct usb_serial *serial, /* Use the firmware already in the device */ err = 0; } else { + if (fw_p->size <= VER_ADDR_3) { + dev_err(&serial->interface->dev, + "Firmware %s is too short\n", buf); + err = -EINVAL; + goto out; + } + local_ver = ((fw_p->data[VER_ADDR_1] << 16) | (fw_p->data[VER_ADDR_2] << 8) | fw_p->data[VER_ADDR_3]); |