diff options
| author |   Jakub Kicinski <kuba@kernel.org> | 2026-05-22 16:13:12 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-05-26 08:19:33 -0700 |
| commit | d5551f4c1800dc714cec86647bdd651ae0de923e (patch) | |
| tree | 1286df8c0b8ebfa80822f625cb198c469b14d802 /include/linux/amba/ssh:/git@git.zx2c4.com | |
| parent | ethtool: cmis: validate start_cmd_payload_size from module (diff) | |
ethtool: cmis: validate fw->size against start_cmd_payload_size
cmis_fw_update_start_download() copies start_cmd_payload_size bytes
from the firmware blob into the CDB LPL vendor_data[] payload without
validating that the FW has enough data.
Since the start_cmd_payload_size can only be ~120B an image too short
is most likely corrupted, so reject it.
Fixes: c4f78134d45c ("ethtool: cmis_fw_update: add a layer for supporting firmware update using CDB")
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Danielle Ratson <danieller@nvidia.com>
Link: https://patch.msgid.link/20260522231312.1710836-10-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/linux/amba/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions