Re: [PATCH net v2] net: prestera: avoid overreading a short firmware tail
From: Jakub Kicinski
Date: Tue Oct 20 2026 - 15:05:26 EST
On Wed, 14 Oct 2026 11:25:40 +0800 Pengpeng Hou wrote:
> prestera_ldr_fw_send() passes complete 1024-byte blocks to the loader
> and then sends fw_size - pos as the final chunk. Firmware header validation
> does not require the payload size to be a multiple of four. Consequently
> that last chunk can end with one to three bytes, while prestera_ldr_send()
> still loads a full u32 from it and transfers bytes beyond the supplied
> firmware image to the device.
>
> Reserve space for the rounded-up transfer, use unaligned-safe full-word
> loads, and construct the final word from only the remaining bytes with
> zero padding. The firmware image-size register still describes the exact
> payload size. Preserve the existing native-word load and writel_relaxed()
> byte-order convention.
Sounds like well formed image should not require such writes,
so why not reject such send calls as an error?