The download loop streams the blob into the MCU as 32-bit words and reads the last word past the end of a blob whose size is not a multiple of four. The shipped blobs happen to be aligned, so the overread never showed; a truncated or foreign file would carry up to three bytes of whatever follows it into the MCU. Reject it before the first write instead. Fixes: 71e79430117d ("net: phy: air_en8811h: Add the Airoha EN8811H PHY driver") Assisted-by: LLM Signed-off-by: Aleksei Sviridkin --- drivers/net/phy/air_en8811h.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/phy/air_en8811h.c b/drivers/net/phy/air_en8811h.c index 0eeb7b9a4e26..34d2727e8222 100644 --- a/drivers/net/phy/air_en8811h.c +++ b/drivers/net/phy/air_en8811h.c @@ -312,6 +312,12 @@ static int air_write_buf(struct phy_device *phydev, u32 address, int saved_page; int ret = 0; + if (fw->size % 4) { + phydev_err(phydev, "firmware size %zu is not a multiple of 4\n", + fw->size); + return -EINVAL; + } + saved_page = phy_select_page(phydev, AIR_PHY_PAGE_EXTENDED_4); if (saved_page >= 0) { -- 2.53.0