[PATCH] memory: brcmstb_dpfe: validate firmware section sizes

[PATCH] memory: brcmstb_dpfe: validate firmware section sizes

[Pengpeng Hou]

__verify_firmware() reads a firmware header and sums declared
data and instruction section sizes with a trailing checksum.

Require the image to contain the header and checksum, and check each
declared section against the remaining firmware size before computing the
final total.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/memory/brcmstb_dpfe.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 08d9e05b1b33..6846e3dac3d3 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -522,6 +522,9 @@ static int __verify_firmware(struct init_data *init,
 	bool is_big_endian = false;
 	const u32 *chksum_ptr;
 
+	if (fw->size < sizeof(*header) + sizeof(*chksum_ptr))
+		return ERR_INVALID_SIZE;
+
 	if (header->magic == DPFE_BE_MAGIC)
 		is_big_endian = true;
 	else if (header->magic != DPFE_LE_MAGIC)
@@ -539,6 +542,13 @@ static int __verify_firmware(struct init_data *init,
 	if ((dmem_size % sizeof(u32)) != 0 || (imem_size % sizeof(u32)) != 0)
 		return ERR_INVALID_SIZE;
 
+	if (dmem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr))
+		return ERR_INVALID_SIZE;
+
+	if (imem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr) -
+	    dmem_size)
+		return ERR_INVALID_SIZE;
+
 	/*
 	 * The header + the data section + the instruction section + the
 	 * checksum must be equal to the total firmware size.
-- 
2.43.0

Re: [PATCH] memory: brcmstb_dpfe: validate firmware section sizes

[Krzysztof Kozlowski]

On 06/07/2026 11:22, Pengpeng Hou wrote:
> __verify_firmware() reads a firmware header and sums declared
> data and instruction section sizes with a trailing checksum.
> 
> Require the image to contain the header and checksum, and check each
> declared section against the remaining firmware size before computing the
> final total.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/memory/brcmstb_dpfe.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
> index 08d9e05b1b33..6846e3dac3d3 100644
> --- a/drivers/memory/brcmstb_dpfe.c
> +++ b/drivers/memory/brcmstb_dpfe.c
> @@ -522,6 +522,9 @@ static int __verify_firmware(struct init_data *init,
>  	bool is_big_endian = false;
>  	const u32 *chksum_ptr;
>  
> +	if (fw->size < sizeof(*header) + sizeof(*chksum_ptr))
> +		return ERR_INVALID_SIZE;

This looks redundant, there is a check at line 546 for this, no?

> +
>  	if (header->magic == DPFE_BE_MAGIC)
>  		is_big_endian = true;
>  	else if (header->magic != DPFE_LE_MAGIC)
> @@ -539,6 +542,13 @@ static int __verify_firmware(struct init_data *init,
>  	if ((dmem_size % sizeof(u32)) != 0 || (imem_size % sizeof(u32)) != 0)
>  		return ERR_INVALID_SIZE;
>  
> +	if (dmem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr))
> +		return ERR_INVALID_SIZE;
> +
> +	if (imem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr) -
> +	    dmem_size)
> +		return ERR_INVALID_SIZE;

Is this vibe coded with some tools? Look like but I see not Assisted-by
tags.


Best regards,
Krzysztof