github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: phy: air_en8811h: refuse a firmware blob that is not a multiple of 4

Browse Source 
The download loop streams the blob into the MCU as 32-bit words and
reads the last word past the end of a blob whose size is not a multiple
of four. The shipped blobs happen to be aligned, so the overread never
showed; a truncated or foreign file would carry up to three bytes of
whatever follows it into the MCU. Reject it before the first write
instead.

Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns)
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://patch.msgid.link/20260903123650.23855-1-f@lex.la
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Aleksei Sviridkin 2026-09-03 12:36:50 +00:00 committed by Jakub Kicinski
parent 7f1de03e31
commit daf0972d38
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/phy/air_en8811h.c
View File

@ -312,6 +312,12 @@ static int air_write_buf(struct phy_device *phydev, u32 address,
int saved_page;
int ret = 0;
if (fw->size % 4) {
phydev_err(phydev, "firmware size %zu is not a multiple of 4\n",
fw->size);
return -EINVAL;
}
saved_page = phy_select_page(phydev, AIR_PHY_PAGE_EXTENDED_4);
if (saved_page >= 0) {