Commit d5551f4c authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

ethtool: cmis: validate fw->size against start_cmd_payload_size 



cmis_fw_update_start_download() copies start_cmd_payload_size bytes
from the firmware blob into the CDB LPL vendor_data[] payload without
validating that the FW has enough data.

Since the start_cmd_payload_size can only be ~120B an image too short
is most likely corrupted, so reject it.

Fixes: c4f78134 ("ethtool: cmis_fw_update: add a layer for supporting firmware update using CDB")
Reviewed-by: default avatarMaxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: default avatarDanielle Ratson <danieller@nvidia.com>
Link: https://patch.msgid.link/20260522231312.1710836-10-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 12c2496a

net/ethtool/cmis_fw_update.c

+8 −0
Original line number Diff line number Diff line
@@ -130,6 +130,14 @@ cmis_fw_update_start_download(struct ethtool_cmis_cdb *cdb, 
	u8 lpl_len;

	int err;



	if (fw_update->fw->size < vendor_data_size) {

		ethnl_module_fw_flash_ntf_err(fw_update->dev,

					      &fw_update->ntf_params,

					      "Firmware image too small for module's start payload",

					      NULL);

		return -EINVAL;

	}



	pl.image_size = cpu_to_be32(fw_update->fw->size);

	memcpy(pl.vendor_data, fw_update->fw->data, vendor_data_size);