[PATCH v5 3/3] fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

[Sebastian Alba Vives]

mpf_ops_parse_header() reads header_size from the bitstream at
MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression
*(buf + header_size - 1) reads one byte before the buffer start.

Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core
guarantees the buffer is always large enough to reach MPF_HEADER_SIZE_OFFSET.
The only real gap is the zero header_size case, which cannot be resolved
by providing a larger buffer, so return -EINVAL.

Fixes: 5f8d4a9008307 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Sebastian Alba Vives <sebasjosue84@xxxxxxxxx>
---
Changes in v5:
  - Drop the count < MPF_HEADER_SIZE_OFFSET + 1 check. Since
    initial_header_size = 71 is set in mpf_ops, the fpga-mgr core
    already guarantees the buffer covers MPF_HEADER_SIZE_OFFSET.
    Only the zero header_size case remains as a genuine bug.
    Suggested by Xu Yilun.
Changes in v4:
  - Reduce to two minimal fixes: minimum count check and -EINVAL for
    zero header_size (superseded by v5).
Changes in v3:
  - Add overflow check for 32-bit in component size loop.
Changes in v2:
  - Return -EINVAL for header_size == 0, -EAGAIN in block loop,
    add count check before MPF_HEADER_SIZE_OFFSET read.
---
 drivers/fpga/microchip-spi.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c
index dca1a5d..cc8f6d7 100644
--- a/drivers/fpga/microchip-spi.c
+++ b/drivers/fpga/microchip-spi.c
@@ -115,9 +115,6 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr,
 		return -EINVAL;
 	}
 
-	if (count < MPF_HEADER_SIZE_OFFSET + 1)
-		return -EINVAL;
-
 	header_size = *(buf + MPF_HEADER_SIZE_OFFSET);
 	if (!header_size)
 		return -EINVAL;
-- 
2.43.0