wifi: libertas: validate firmware block extents

Browse source

check_fwfile_format() reads each block header and trusts its data length
before proving that both fit in the firmware image. A truncated header or
oversized block can therefore pass malformed extents to the download path.

Require the remaining image to contain the complete header and payload
before accepting each block.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260830140420.26399-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

...

This commit is contained in:

Pengpeng Hou 2026-08-30 22:04:20 +08:00 • committed by Johannes Berg

parent f2e8260ad4

commit c7fee4aaaf

1 changed files with 9 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

drivers/net/wireless/marvell/libertas/if_usb.c

View file