From daf0972d38e999dcfd7a409daaeef69812c1f58d Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Thu, 3 Sep 2026 12:36:50 +0000 Subject: [PATCH] net: phy: air_en8811h: refuse a firmware blob that is not a multiple of 4 The download loop streams the blob into the MCU as 32-bit words and reads the last word past the end of a blob whose size is not a multiple of four. The shipped blobs happen to be aligned, so the overread never showed; a truncated or foreign file would carry up to three bytes of whatever follows it into the MCU. Reject it before the first write instead. Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns) Reviewed-by: Andrew Lunn Signed-off-by: Aleksei Sviridkin Link: https://patch.msgid.link/20260903123650.23855-1-f@lex.la Signed-off-by: Jakub Kicinski --- drivers/net/phy/air_en8811h.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/phy/air_en8811h.c b/drivers/net/phy/air_en8811h.c index 38eb18f0e9bb..ec7c44ca68e7 100644 --- a/drivers/net/phy/air_en8811h.c +++ b/drivers/net/phy/air_en8811h.c @@ -312,6 +312,12 @@ static int air_write_buf(struct phy_device *phydev, u32 address, int saved_page; int ret = 0; + if (fw->size % 4) { + phydev_err(phydev, "firmware size %zu is not a multiple of 4\n", + fw->size); + return -EINVAL; + } + saved_page = phy_select_page(phydev, AIR_PHY_PAGE_EXTENDED_4); if (saved_page >= 0) {