[PATCH] net: prestera: avoid overreading a short firmware tail

[PATCH] net: prestera: avoid overreading a short firmware tail

[Pengpeng Hou]

prestera_ldr_send() writes the firmware in 32-bit words even when the final
chunk is not four-byte aligned. The last iteration then reads a full u32
from a one-to-three-byte tail.

Reserve the aligned ring space, use unaligned-safe full-word loads, and
zero-pad a partial final word without reading beyond the firmware image.

Fixes: 4c2703dfd7fa ("net: marvell: prestera: Add PCI interface support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/net/ethernet/marvell/prestera/prestera_pci.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_pci.c b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
index 1ad0e62a8433b..9b3d6e5a81d1c 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_pci.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
@@ -589,17 +589,26 @@ static u8 __iomem *prestera_ldr_wr_ptr(struct prestera_fw *fw)
 
 static int prestera_ldr_send(struct prestera_fw *fw, const u8 *buf, size_t len)
 {
+	size_t write_len = ALIGN(len, sizeof(u32));
+	size_t i;
 	int err;
-	int i;
 
-	err = prestera_ldr_wait_buf(fw, len);
+	err = prestera_ldr_wait_buf(fw, write_len);
 	if (err) {
 		dev_err(fw->dev.dev, "failed wait for sending firmware\n");
 		return err;
 	}
 
-	for (i = 0; i < len; i += 4) {
-		writel_relaxed(*(u32 *)(buf + i), prestera_ldr_wr_ptr(fw));
+	for (i = 0; i + sizeof(u32) <= len; i += sizeof(u32)) {
+		writel_relaxed(get_unaligned((u32 *)(buf + i)),
+			       prestera_ldr_wr_ptr(fw));
+		prestera_ldr_wr_idx_move(fw, 4);
+	}
+	if (i < len) {
+		u32 last = 0;
+
+		memcpy(&last, buf + i, len - i);
+		writel_relaxed(last, prestera_ldr_wr_ptr(fw));
 		prestera_ldr_wr_idx_move(fw, 4);
 	}

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1

Re: [PATCH] net: prestera: avoid overreading a short firmware tail

[Andrew Lunn]

On Sun, Aug 30, 2026 at 10:24:03PM +0800, Pengpeng Hou wrote:
> prestera_ldr_send() writes the firmware in 32-bit words even when the final
> chunk is not four-byte aligned. The last iteration then reads a full u32
> from a one-to-three-byte tail.
> 
> Reserve the aligned ring space, use unaligned-safe full-word loads, and
> zero-pad a partial final word without reading beyond the firmware image.

"What?" a patch does i can see by reading the code. So the commit
message should explain "Why?" you want to make this change.

    Andrew

---
pw-bot: cr

Re: [PATCH] net: prestera: avoid overreading a short firmware tail

[kernel test robot]

Hi Pengpeng,

kernel test robot noticed the following build errors:

[auto build test ERROR on 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72]

url:    https://github.com/intel-lab-lkp/linux/commits/Pengpeng-Hou/net-prestera-avoid-overreading-a-short-firmware-tail/20260830-222403
base:   08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
patch link:    https://lore.kernel.org/r/20260830142404.37663-1-pengpeng%40iscas.ac.cn
patch subject: [PATCH] net: prestera: avoid overreading a short firmware tail
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20260902/202609022030.0pnwZKgS-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260902/202609022030.0pnwZKgS-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609022030.0pnwZKgS-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/net/ethernet/marvell/prestera/prestera_pci.c:603:18: error: call to undeclared function 'get_unaligned'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     603 |                 writel_relaxed(get_unaligned((u32 *)(buf + i)),
         |                                ^
   1 error generated.


vim +/get_unaligned +603 drivers/net/ethernet/marvell/prestera/prestera_pci.c

   589	
   590	static int prestera_ldr_send(struct prestera_fw *fw, const u8 *buf, size_t len)
   591	{
   592		size_t write_len = ALIGN(len, sizeof(u32));
   593		size_t i;
   594		int err;
   595	
   596		err = prestera_ldr_wait_buf(fw, write_len);
   597		if (err) {
   598			dev_err(fw->dev.dev, "failed wait for sending firmware\n");
   599			return err;
   600		}
   601	
   602		for (i = 0; i + sizeof(u32) <= len; i += sizeof(u32)) {
 > 603			writel_relaxed(get_unaligned((u32 *)(buf + i)),
   604				       prestera_ldr_wr_ptr(fw));
   605			prestera_ldr_wr_idx_move(fw, 4);
   606		}
   607		if (i < len) {
   608			u32 last = 0;
   609	
   610			memcpy(&last, buf + i, len - i);
   611			writel_relaxed(last, prestera_ldr_wr_ptr(fw));
   612			prestera_ldr_wr_idx_move(fw, 4);
   613		}
   614	
   615		prestera_ldr_wr_idx_commit(fw);
   616		return 0;
   617	}
   618	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] net: prestera: avoid overreading a short firmware tail

[kernel test robot]

Hi Pengpeng,

kernel test robot noticed the following build errors:

[auto build test ERROR on 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72]

url:    https://github.com/intel-lab-lkp/linux/commits/Pengpeng-Hou/net-prestera-avoid-overreading-a-short-firmware-tail/20260830-222403
base:   08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
patch link:    https://lore.kernel.org/r/20260830142404.37663-1-pengpeng%40iscas.ac.cn
patch subject: [PATCH] net: prestera: avoid overreading a short firmware tail
config: i386-allyesconfig (https://download.01.org/0day-ci/archive/20260903/202609032140.39rhcpus-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260903/202609032140.39rhcpus-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609032140.39rhcpus-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/linux/io.h:12,
                    from include/linux/iopoll.h:14,
                    from drivers/net/ethernet/marvell/prestera/prestera_pci.c:8:
   drivers/net/ethernet/marvell/prestera/prestera_pci.c: In function 'prestera_ldr_send':
>> drivers/net/ethernet/marvell/prestera/prestera_pci.c:603:32: error: implicit declaration of function 'get_unaligned'; did you mean 'get_cmdline'? [-Wimplicit-function-declaration]
     603 |                 writel_relaxed(get_unaligned((u32 *)(buf + i)),
         |                                ^~~~~~~~~~~~~
   arch/x86/include/asm/io.h:88:39: note: in definition of macro 'writel_relaxed'
      88 | #define writel_relaxed(v, a) __writel(v, a)
         |                                       ^


vim +603 drivers/net/ethernet/marvell/prestera/prestera_pci.c

   589	
   590	static int prestera_ldr_send(struct prestera_fw *fw, const u8 *buf, size_t len)
   591	{
   592		size_t write_len = ALIGN(len, sizeof(u32));
   593		size_t i;
   594		int err;
   595	
   596		err = prestera_ldr_wait_buf(fw, write_len);
   597		if (err) {
   598			dev_err(fw->dev.dev, "failed wait for sending firmware\n");
   599			return err;
   600		}
   601	
   602		for (i = 0; i + sizeof(u32) <= len; i += sizeof(u32)) {
 > 603			writel_relaxed(get_unaligned((u32 *)(buf + i)),
   604				       prestera_ldr_wr_ptr(fw));
   605			prestera_ldr_wr_idx_move(fw, 4);
   606		}
   607		if (i < len) {
   608			u32 last = 0;
   609	
   610			memcpy(&last, buf + i, len - i);
   611			writel_relaxed(last, prestera_ldr_wr_ptr(fw));
   612			prestera_ldr_wr_idx_move(fw, 4);
   613		}
   614	
   615		prestera_ldr_wr_idx_commit(fw);
   616		return 0;
   617	}
   618	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki