Re: [PATCH] USB: serial: mxuport: validate firmware header size

[Johan Hovold <johan@kernel.org>]

On Wed, Jul 15, 2026 at 07:17:33PM +0200, Andrew Lunn wrote:
> On Wed, Jul 15, 2026 at 04:46:11PM +0800, Pengpeng Hou wrote:
> > mxuport_probe() reads version bytes at fixed offsets after
> > request_firmware() succeeds. Firmware loading success does not prove that
> > the blob contains the whole header.
> > 
> > Reject blobs that do not reach the highest version byte before
> > dereferencing them.
> > 
> > Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
> 
> Does this bother people?
> 
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> 
> I would suggest dropping the Fixes tag, unless you can point to
> reports of this crashing.

I'd say not validating input is still a bug even if it should not be
backported to stable.

Here we may end up leaking three bytes beyond the buffer to the logs,
but of course only root should be able to corrupt the fw file in the
first place.

So I'll add back the Fixes tag (without adding CC-stable) when applying
v2.
 
> > Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> 
> Reviewed-by: Andrew Lunn <andrew@lunn.ch>

Thanks for reviewing.

Johan