[PATCH net v2] net: prestera: validate firmware header length

[PATCH net v2] net: prestera: validate firmware header length

[Pengpeng Hou]

prestera_fw_hdr_parse() reads the firmware header before checking
that the firmware image contains that header.

Reject images shorter than struct prestera_fw_header before decoding the
magic and version fields.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1: https://lore.kernel.org/all/20260706092602.79240-1-pengpeng@iscas.ac.cn/
- target the net tree in the Subject as requested by Andrew Lunn
- rebase onto the current tree

 drivers/net/ethernet/marvell/prestera/prestera_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_pci.c b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
index 2989a77e3b42..1ad0e62a8433 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_pci.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
@@ -684,6 +684,9 @@ static int prestera_fw_hdr_parse(struct prestera_fw *fw)
 	struct prestera_fw_header *hdr;
 	u32 magic;
 
+	if (fw->bin->size < sizeof(*hdr))
+		return -EINVAL;
+
 	hdr = (struct prestera_fw_header *)fw->bin->data;
 
 	magic = be32_to_cpu(hdr->magic_number);
-- 
2.50.1

RE: [EXTERNAL] [PATCH net v2] net: prestera: validate firmware header length

[Elad Nachman]

>
>
> From: Pengpeng Hou <pengpeng@iscas.ac.cn>
> Sent: Friday, July 31, 2026 5:19 PM
> To: Elad Nachman <enachman@marvell.com>
> Cc: Andrew Lunn <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Pengpeng Hou <pengpeng@iscas.ac.cn>
> Subject: [EXTERNAL] [PATCH net v2] net: prestera: validate firmware header length
>
> prestera_fw_hdr_parse() reads the firmware header before checking
> that the firmware image contains that header.
>
> Reject images shorter than struct prestera_fw_header before decoding the
> magic and version fields.
>
> Signed-off-by: Pengpeng Hou <mailto:pengpeng@iscas.ac.cn>
> ---
> Changes since v1
> - target the net tree in the Subject as requested by Andrew Lunn
> - rebase onto the current tree
>
>  drivers/net/ethernet/marvell/prestera/prestera_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_pci.c b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
> index 2989a77e3b42..1ad0e62a8433 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_pci.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
> @@ -684,6 +684,9 @@ static int prestera_fw_hdr_parse(struct prestera_fw *fw)
>       struct prestera_fw_header *hdr;
>       u32 magic;
>
> +     if (fw->bin->size < sizeof(*hdr))
> +             return -EINVAL;
> +
>       hdr = (struct prestera_fw_header *)fw->bin->data;
>
>       magic = be32_to_cpu(hdr->magic_number);
> --
> 2.50.1
>

Acked-by: Elad Nachman <enachman@marvell.com>

Re: [PATCH net v2] net: prestera: validate firmware header length

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 31 Jul 2026 22:19:06 +0800 you wrote:
> prestera_fw_hdr_parse() reads the firmware header before checking
> that the firmware image contains that header.
> 
> Reject images shorter than struct prestera_fw_header before decoding the
> magic and version fields.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> 
> [...]

Here is the summary with links:
  - [net,v2] net: prestera: validate firmware header length
    https://git.kernel.org/netdev/net/c/8ae344eb540a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html