Re: [PATCH v2] USB: serial: io_ti: reject oversized boot-mode firmware

[Johan Hovold]

On Mon, Jul 20, 2026 at 07:48:17PM +0800, Pengpeng Hou wrote:
> do_boot_mode() copies the firmware payload, excluding its four-byte prefix,
> into a fixed 15.5 KiB staging buffer. check_fw_sanity() already proves that
> the image contains its seven-byte header and validates the declared image
> length and checksum, but it does not impose this boot-mode destination
> limit.
> 
> Reject images whose payload does not fit before allocating and filling the
> staging buffer.
> 
> Fixes: d12b219a228e ("edgeport-ti: use request_firmware()")
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
> Changes since v1: https://lore.kernel.org/all/20260701053535.39951-1-pengpeng@xxxxxxxxxxx/
> - drop the redundant short-image check already provided by check_fw_sanity()
> - state that the issue was found by source review
> - add the requested Fixes tag
> - rebase onto v7.2-rc4

Applied, thanks.

Johan