čt 27. 8. 2026 v 7:13 odesílatel Pranav Tilak <[email protected]> napsal: > > fpga_loadbitstream() receives a size argument describing the length of > the caller's buffer but never uses it. All header offsets are read from > the bitstream, including the 32-bit data length at tag 0x65, which is > passed to fpga_load() unmodified and becomes the DMA transfer length. > A header declaring more data than the caller supplied makes the DMA > read beyond the end of the buffer. > > Reject the bitstream if its header and the data it declares do not > fit within size. > > Fixes: c26acc1a43b3 ("Remove bit swapping in Xilinx Spartan bitfile loading") > Signed-off-by: Pranav Tilak <[email protected]> > --- > drivers/fpga/xilinx.c | 9 +++++++++ > 1 file changed, 9 insertions(+)
Applied. M -- Michal Simek, Ing. (M.Eng), OpenPGP -> KeyID: FE3D1F91 w: www.monstr.eu p: +42-0-721842854 Maintainer of Linux kernel - Xilinx Microblaze Maintainer of Linux kernel - Xilinx Zynq ARM and ZynqMP ARM64 SoCs U-Boot custodian - Xilinx Microblaze/Zynq/ZynqMP/Versal SoCs
