[PATCH] USB: serial: io_ti: reject oversized boot-mode firmware images

[PATCH] USB: serial: io_ti: reject oversized boot-mode firmware images

[Pengpeng Hou]

do_boot_mode() allocates a fixed 15.5 KiB staging buffer plus the I2C
image header and then copies fw->size - 4 bytes into it.
check_fw_sanity() validates the firmware's internal record accounting,
but the boot-mode copy still needs to prove that the raw firmware
payload fits in the fixed staging buffer.

Reject firmware images that are shorter than the skipped 4-byte prefix
or whose remaining payload exceeds the staging buffer before copying the
data.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/usb/serial/io_ti.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index d48819d7..3bdcbd6f 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1466,6 +1466,12 @@ static int do_boot_mode(struct edgeport_serial *serial,
 		/* Allocate a 15.5k buffer + 3 byte header */
 		buffer_size = (((1024 * 16) - 512) +
 					sizeof(struct ti_i2c_image_header));
+		if (fw->size < 4 || fw->size - 4 > buffer_size) {
+			dev_err(dev, "%s - firmware image is too large\n",
+				__func__);
+			return -EINVAL;
+		}
+
 		buffer = kmalloc(buffer_size, GFP_KERNEL);
 		if (!buffer)
 			return -ENOMEM;

Re: [PATCH] USB: serial: io_ti: reject oversized boot-mode firmware images

[Johan Hovold]

On Wed, Jul 01, 2026 at 01:35:35PM +0800, Pengpeng Hou wrote:
> do_boot_mode() allocates a fixed 15.5 KiB staging buffer plus the I2C
> image header and then copies fw->size - 4 bytes into it.
> check_fw_sanity() validates the firmware's internal record accounting,
> but the boot-mode copy still needs to prove that the raw firmware
> payload fits in the fixed staging buffer.
> 
> Reject firmware images that are shorter than the skipped 4-byte prefix
> or whose remaining payload exceeds the staging buffer before copying the
> data.

check_fw_sanity() already makes sure that the image has a 7-byte header
so the commit message and check below needs to be updated.

Also, how was this issue found?

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Please add a Fixes tag as well.

> ---
>  drivers/usb/serial/io_ti.c |    6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
> index d48819d7..3bdcbd6f 100644
> --- a/drivers/usb/serial/io_ti.c
> +++ b/drivers/usb/serial/io_ti.c
> @@ -1466,6 +1466,12 @@ static int do_boot_mode(struct edgeport_serial *serial,
>  		/* Allocate a 15.5k buffer + 3 byte header */
>  		buffer_size = (((1024 * 16) - 512) +
>  					sizeof(struct ti_i2c_image_header));
> +		if (fw->size < 4 || fw->size - 4 > buffer_size) {

Just drop the < 4 check, or possibly keep it with a comment about it
being redundant because of check_fw_sanity().

> +			dev_err(dev, "%s - firmware image is too large\n",
> +				__func__);
> +			return -EINVAL;
> +		}
> +
>  		buffer = kmalloc(buffer_size, GFP_KERNEL);
>  		if (!buffer)
>  			return -ENOMEM;

Johan