diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-08-15 21:45:59 +0800 |
|---|---|---|
| committer | Krzysztof Kozlowski <krzk@kernel.org> | 2026-09-04 15:53:16 +0200 |
| commit | e61c1a1103e2617e8f86288368911a8591e35c1e (patch) | |
| tree | 3598317cc10a8e478112b7c295b411b5df7c931c /tools/perf/scripts/python/stackcollapse.py | |
| parent | c8d0e87bc2413c6a3f92c7130a4cbad51f8703da (diff) | |
memory: brcmstb_dpfe: validate firmware section sizes
The firmware header is read before the image has been shown to contain a
complete header. In addition, the final size check adds two
firmware-provided u32 section lengths before comparing the result with
fw->size, so the addition can wrap.
Reject images shorter than the fixed header and checksum before reading
the header. Then derive the available payload length with subtraction and
require the two declared sections to fill it exactly.
Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260815134559.47888-1-pengpeng@iscas.ac.cn
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions