[PATCH] USB: serial: mxuport: validate firmware header size

[PATCH] USB: serial: mxuport: validate firmware header size

[Pengpeng Hou]

mxuport_probe() reads version bytes at fixed offsets after
request_firmware() succeeds. Firmware loading success does not prove that
the blob contains the whole header.

Reject blobs that do not reach the highest version byte before
dereferencing them.

Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/usb/serial/mxuport.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
index e3c5a1b97542..fa7438ea8fef 100644
--- a/drivers/usb/serial/mxuport.c
+++ b/drivers/usb/serial/mxuport.c
@@ -1080,6 +1080,13 @@ static int mxuport_probe(struct usb_serial *serial,
 		/* Use the firmware already in the device */
 		err = 0;
 	} else {
+		if (fw_p->size <= VER_ADDR_3) {
+			dev_err(&serial->interface->dev,
+				"Firmware %s is too small\n", buf);
+			err = -EINVAL;
+			goto out;
+		}
+
 		local_ver = ((fw_p->data[VER_ADDR_1] << 16) |
 			     (fw_p->data[VER_ADDR_2] << 8) |
 			     fw_p->data[VER_ADDR_3]);
-- 
2.43.0

Re: [PATCH] USB: serial: mxuport: validate firmware header size

[Andrew Lunn]

On Wed, Jul 15, 2026 at 04:46:11PM +0800, Pengpeng Hou wrote:
> mxuport_probe() reads version bytes at fixed offsets after
> request_firmware() succeeds. Firmware loading success does not prove that
> the blob contains the whole header.
> 
> Reject blobs that do not reach the highest version byte before
> dereferencing them.
> 
> Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")

Does this bother people?

https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

I would suggest dropping the Fixes tag, unless you can point to
reports of this crashing.

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH] USB: serial: mxuport: validate firmware header size

[Johan Hovold]

On Wed, Jul 15, 2026 at 07:17:33PM +0200, Andrew Lunn wrote:
> On Wed, Jul 15, 2026 at 04:46:11PM +0800, Pengpeng Hou wrote:
> > mxuport_probe() reads version bytes at fixed offsets after
> > request_firmware() succeeds. Firmware loading success does not prove that
> > the blob contains the whole header.
> > 
> > Reject blobs that do not reach the highest version byte before
> > dereferencing them.
> > 
> > Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
> 
> Does this bother people?
> 
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> 
> I would suggest dropping the Fixes tag, unless you can point to
> reports of this crashing.

I'd say not validating input is still a bug even if it should not be
backported to stable.

Here we may end up leaking three bytes beyond the buffer to the logs,
but of course only root should be able to corrupt the fw file in the
first place.

So I'll add back the Fixes tag (without adding CC-stable) when applying
v2.
 
> > Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> 
> Reviewed-by: Andrew Lunn <andrew@lunn.ch>

Thanks for reviewing.

Johan