diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-07-30 18:05:28 +0545 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-08-07 15:38:32 -0400 |
| commit | 2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4 (patch) | |
| tree | 587063e8838a1380d9fdc5d59aa2efdecd18efd0 /tools/perf/scripts/python/bin/stackcollapse-report | |
| parent | ad28b52441bc0b89ebf7ecb79a2765aa23db4d42 (diff) | |
Bluetooth: hci_aml: validate firmware segment lengths
aml_download_firmware() reads two lengths from the firmware header and
uses them to build pointers before checking that the header and segment
data are present. A truncated or inconsistent firmware image can make
the driver read past firmware->data while constructing TCI commands.
Reject images shorter than the header and ensure that the ICCM and DCCM
ranges fit within the loaded firmware before downloading either segment.
Fixes: 37bac77e4649 ("Bluetooth: hci_uart: Add support for Amlogic HCI UART")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-report')
0 files changed, 0 insertions, 0 deletions