[PATCH] scsi: efct: validate firmware header size

[Pengpeng Hou]

The optional firmware update path casts the firmware blob to
efct_hw_grp_hdr and reads its revision before checking that the blob covers
the complete header.

Reject undersized firmware images before accessing header fields.

Fixes: 4df84e846624 ("scsi: elx: efct: Driver initialization routines")
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/scsi/elx/efct/efct_driver.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/scsi/elx/efct/efct_driver.c b/drivers/scsi/elx/efct/efct_driver.c
index 07c2f453459e1..b0d8ca58daebe 100644
--- a/drivers/scsi/elx/efct/efct_driver.c
+++ b/drivers/scsi/elx/efct/efct_driver.c
@@ -338,6 +338,10 @@ efct_request_firmware_update(struct efct *efct)
 		efc_log_debug(efct, "Firmware file(%s) not found.\n", file_name);
 		return rc;
 	}
+	if (fw->size < sizeof(*fw_image)) {
+		rc = -EINVAL;
+		goto exit;
+	}
 
 	fw_image = (struct efct_hw_grp_hdr *)fw->data;

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1