[PATCH] USB: serial: mxuport: validate firmware header size
From: Pengpeng Hou
Date: Wed Jul 15 2026 - 04:52:12 EST
mxuport_probe() reads version bytes at fixed offsets after
request_firmware() succeeds. Firmware loading success does not prove that
the blob contains the whole header.
Reject blobs that do not reach the highest version byte before
dereferencing them.
Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver")
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
drivers/usb/serial/mxuport.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
index e3c5a1b97542..fa7438ea8fef 100644
--- a/drivers/usb/serial/mxuport.c
+++ b/drivers/usb/serial/mxuport.c
@@ -1080,6 +1080,13 @@ static int mxuport_probe(struct usb_serial *serial,
/* Use the firmware already in the device */
err = 0;
} else {
+ if (fw_p->size <= VER_ADDR_3) {
+ dev_err(&serial->interface->dev,
+ "Firmware %s is too small\n", buf);
+ err = -EINVAL;
+ goto out;
+ }
+
local_ver = ((fw_p->data[VER_ADDR_1] << 16) |
(fw_p->data[VER_ADDR_2] << 8) |
fw_p->data[VER_ADDR_3]);
--
2.43.0