net: phy: air_en8811h: refuse a firmware blob that is not a multiple of 4

Browse source

The download loop streams the blob into the MCU as 32-bit words and
reads the last word past the end of a blob whose size is not a multiple
of four. The shipped blobs happen to be aligned, so the overread never
showed; a truncated or foreign file would carry up to three bytes of
whatever follows it into the MCU. Reject it before the first write
instead.

Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns)
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://patch.msgid.link/20260903123650.23855-1-f@lex.la
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Aleksei Sviridkin 2026-09-03 12:36:50 +00:00 • committed by Jakub Kicinski

parent 7f1de03e31

commit daf0972d38

1 changed files with 6 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/net/phy/air_en8811h.c

View file