[PATCH] memory: brcmstb_dpfe: validate firmware section sizes

[Krzysztof Kozlowski]

On 06/07/2026 11:22, Pengpeng Hou wrote:
> __verify_firmware() reads a firmware header and sums declared
> data and instruction section sizes with a trailing checksum.
> 
> Require the image to contain the header and checksum, and check each
> declared section against the remaining firmware size before computing the
> final total.
> 
> Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
> ---
>  drivers/memory/brcmstb_dpfe.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
> index 08d9e05b1b33..6846e3dac3d3 100644
> --- a/drivers/memory/brcmstb_dpfe.c
> +++ b/drivers/memory/brcmstb_dpfe.c
> @@ -522,6 +522,9 @@ static int __verify_firmware(struct init_data *init,
>  	bool is_big_endian = false;
>  	const u32 *chksum_ptr;
>  
> +	if (fw->size < sizeof(*header) + sizeof(*chksum_ptr))
> +		return ERR_INVALID_SIZE;

This looks redundant, there is a check at line 546 for this, no?

> +
>  	if (header->magic == DPFE_BE_MAGIC)
>  		is_big_endian = true;
>  	else if (header->magic != DPFE_LE_MAGIC)
> @@ -539,6 +542,13 @@ static int __verify_firmware(struct init_data *init,
>  	if ((dmem_size % sizeof(u32)) != 0 || (imem_size % sizeof(u32)) != 0)
>  		return ERR_INVALID_SIZE;
>  
> +	if (dmem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr))
> +		return ERR_INVALID_SIZE;
> +
> +	if (imem_size > fw->size - sizeof(*header) - sizeof(*chksum_ptr) -
> +	    dmem_size)
> +		return ERR_INVALID_SIZE;

Is this vibe coded with some tools? Look like but I see not Assisted-by
tags.


Best regards,
Krzysztof