Re: [PATCH net v2] net: qlcnic: validate unified ROM sections before loading

[Simon Horman <horms@kernel.org>]

On Sun, Aug 16, 2026 at 01:21:09PM +0800, Pengpeng Hou wrote:
> The unified ROM parser reads directory, product, and data-descriptor fields
> from the firmware file.  Existing validation forms table and data ends with
> unchecked additions and multiplications.  Malformed values can wrap before
> they are compared with the firmware size.  The parser also dereferences
> typed pointers at firmware-controlled offsets.
> 
> Valid descriptor extents alone are insufficient for the consumers.  The
> loader reads a fixed-size bootloader regardless of its declared size, the
> version parser assumes a 17-byte tail, and a partial final firmware word is
> read as a full u64.  A truncated image can therefore make the driver read
> beyond the firmware allocation during validation or loading.
> 
> Replace the pointer-returning parser with bounded range helpers.  Validate
> table entry sizes, descriptor indices, section ranges, the fixed
> bootloader load length, and the version tail before exposing any section.
> Read all file fields with unaligned little-endian accessors and assemble a
> partial final word from only the bytes that remain.  Apply the same range
> checks to the legacy image before reading its fixed fields.
> 
> Fixes: af19b49152bd ("qlcnic: Qlogic ethernet driver for CNA devices")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> Changes since v1:
> - follow reverse-xmas-tree declaration order and drop unrelated whitespace
> - replace firmware structure casts with bounded unaligned reads
> - validate directory and data-table entry sizes and descriptor indices
> - require the bootloader section to cover the fixed load length
> - require the firmware section to contain the 17-byte version tail
> - avoid a full-u64 read for a partial final firmware word
> - validate fixed legacy-image fields before reading them
> 
> v1: https://lore.kernel.org/all/20260706093601.81535-1-pengpeng@iscas.ac.cn/
> 
> Validation:
> - scripts/checkpatch.pl --no-tree --strict: clean
> - git diff --check: clean
> - manual source-level audit of directory, product, descriptor, version, and
>   loader consumers

Thanks for the updates.
And for including information on your validation steps.

Reviewed-by: Simon Horman <horms@kernel.org>