diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-08-30 22:04:20 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-04 12:14:44 +0200 |
| commit | c7fee4aaaf9294ef9f86eb69464e89fe096ba5db (patch) | |
| tree | bb8a57400f6d71ade77c89c0c2ac30d5263a708d | |
| parent | f2e8260ad4093f9921b07686eb5cc027c38b1c7d (diff) | |
| download | linux-next-c7fee4aaaf9294ef9f86eb69464e89fe096ba5db.tar.gz linux-next-c7fee4aaaf9294ef9f86eb69464e89fe096ba5db.zip | |
wifi: libertas: validate firmware block extents
check_fwfile_format() reads each block header and trusts its data length
before proving that both fit in the firmware image. A truncated header or
oversized block can therefore pass malformed extents to the download path.
Require the remaining image to contain the complete header and payload
before accepting each block.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260830140420.26399-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | drivers/net/wireless/marvell/libertas/if_usb.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c index 5cc0c5cac257..74870c9bd091 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -798,10 +798,18 @@ static int check_fwfile_format(const uint8_t *data, uint32_t totlen) exit = len = 0; do { - struct fwheader *fwh = (void *)data; + struct fwheader *fwh; + + if (totlen - len < sizeof(*fwh)) + break; + + fwh = (void *)data; bincmd = le32_to_cpu(fwh->dnldcmd); blksize = le32_to_cpu(fwh->datalength); + if (blksize > totlen - len - sizeof(*fwh)) + break; + switch (bincmd) { case FW_HAS_DATA_TO_RECV: offset = sizeof(struct fwheader) + blksize; |