diff options
| author | Aleksei Sviridkin <f@lex.la> | 2026-09-03 12:36:50 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-04 16:08:45 -0700 |
| commit | daf0972d38e999dcfd7a409daaeef69812c1f58d (patch) | |
| tree | 7c6b8b46284adcdf613201dc53988a5f6953a5e2 | |
| parent | 7f1de03e31033590279e4f8fc01ddf2c5dcfab51 (diff) | |
| download | linux-next-daf0972d38e999dcfd7a409daaeef69812c1f58d.tar.gz linux-next-daf0972d38e999dcfd7a409daaeef69812c1f58d.zip | |
net: phy: air_en8811h: refuse a firmware blob that is not a multiple of 4
The download loop streams the blob into the MCU as 32-bit words and
reads the last word past the end of a blob whose size is not a multiple
of four. The shipped blobs happen to be aligned, so the overread never
showed; a truncated or foreign file would carry up to three bytes of
whatever follows it into the MCU. Reject it before the first write
instead.
Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns)
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://patch.msgid.link/20260903123650.23855-1-f@lex.la
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/phy/air_en8811h.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/phy/air_en8811h.c b/drivers/net/phy/air_en8811h.c index 38eb18f0e9bb..ec7c44ca68e7 100644 --- a/drivers/net/phy/air_en8811h.c +++ b/drivers/net/phy/air_en8811h.c @@ -312,6 +312,12 @@ static int air_write_buf(struct phy_device *phydev, u32 address, int saved_page; int ret = 0; + if (fw->size % 4) { + phydev_err(phydev, "firmware size %zu is not a multiple of 4\n", + fw->size); + return -EINVAL; + } + saved_page = phy_select_page(phydev, AIR_PHY_PAGE_EXTENDED_4); if (saved_page >= 0) { |