USB: serial: mxuport: validate firmware header size

mxuport_probe() reads version bytes at fixed offsets after
request_firmware() succeeds. Firmware loading success does not prove that
the blob reaches the highest version offset.

Reject short firmware images before reading the version bytes. This is
source-level parser hardening; no affected device or crash was observed.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
Signed-off-by: Johan Hovold <johan@kernel.org>

diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
index e3c5a1b975420db4e4586de95c737948852541b0..088d5dd8abb5ba7d3701ead25479bfedf56f8eaa 100644 (file)
--- a/drivers/usb/serial/mxuport.c
+++ b/drivers/usb/serial/mxuport.c
@@ -1080,6 +1080,13 @@ static int mxuport_probe(struct usb_serial *serial,
                /* Use the firmware already in the device */
                err = 0;
        } else {
+               if (fw_p->size <= VER_ADDR_3) {
+                       dev_err(&serial->interface->dev,
+                               "Firmware %s is too short\n", buf);
+                       err = -EINVAL;
+                       goto out;
+               }
+
                local_ver = ((fw_p->data[VER_ADDR_1] << 16) |
                             (fw_p->data[VER_ADDR_2] << 8) |
                             fw_p->data[VER_ADDR_3]);