]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
authorDan Carpenter <dan.carpenter@linaro.org>
Wed, 28 May 2025 20:22:19 +0000 (23:22 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 15 Aug 2025 10:05:03 +0000 (12:05 +0200)
commit7deb7b5632b5b0b6b15fd96456e0878537f093df
tree815472798dc1797b329e6173ab0aca6b22423493
parent6ba32d6006c755c3c00f0480dada82ed81874887
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()

[ Upstream commit 8b61d8ca751bc15875b50e0ff6ac3ba0cf95a529 ]

The "rec->len" value comes from the firmware.  We generally do
trust firmware, but it's always better to double check.  If
the length value is too large it would lead to memory corruption
when we set "data[i] = ret;"

Fixes: 217209db0204 ("watchdog: ziirave_wdt: Add support to upload the firmware.")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/3b58b453f0faa8b968c90523f52c11908b56c346.1748463049.git.dan.carpenter@linaro.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/watchdog/ziirave_wdt.c