[PATCH v2] memory: brcmstb_dpfe: validate firmware section sizes

Krzysztof Kozlowski krzk at kernel.org
Fri Sep 4 06:54:39 PDT 2026


On Sat, 15 Aug 2026 21:45:59 +0800, Pengpeng Hou wrote:
> The firmware header is read before the image has been shown to contain a
> complete header. In addition, the final size check adds two
> firmware-provided u32 section lengths before comparing the result with
> fw->size, so the addition can wrap.
> 
> Reject images shorter than the fixed header and checksum before reading
> the header. Then derive the available payload length with subtraction and
> require the two declared sections to fill it exactly.
> 
> [...]

Applied, thanks!

[1/1] memory: brcmstb_dpfe: validate firmware section sizes
      https://git.kernel.org/krzk/linux-mem-ctrl/c/e61c1a1103e2617e8f86288368911a8591e35c1e

Best regards,
-- 
Krzysztof Kozlowski <krzk at kernel.org>




More information about the linux-arm-kernel mailing list