mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-20 19:23:40 +00:00
f2737dc40d
The batched into_buf test path allocates TEST_FIRMWARE_BUF_SIZE bytes unconditionally, but then passes test_fw_config->buf_size to request_firmware_into_buf() or request_partial_firmware_into_buf(). Userspace can set config_buf_size above TEST_FIRMWARE_BUF_SIZE before triggering a batched request. If the firmware file is large enough, the firmware loader writes past the end of the 1 KiB test buffer. Allocate the buffer with the same size that the test passes to the firmware API so config_buf_size remains the actual buffer size under test. Assisted-by: Codex:gpt-5.5-cyber-preview Link: https://lore.kernel.org/20260605003038.2005840-1-sam.moelius@trailofbits.com Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Kees Cook <kees@kernel.org> Cc: Luis R. Rodriguez <mcgrof@kernel.org> Cc: Scott Branden <scott.branden@broadcom.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1572 lines
38 KiB
1572 lines
38 KiB