The download loop streams the blob into the MCU as 32-bit words and
reads the last word past the end of a blob whose size is not a multiple
of four. The shipped blobs happen to be aligned, so the overread never
showed; a truncated or foreign file would carry up to three bytes of
whatever follows it into the MCU. Reject it before the first write
instead.

Fixes: 71e79430117d ("net: phy: air_en8811h: Add the Airoha EN8811H PHY driver")
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 drivers/net/phy/air_en8811h.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/phy/air_en8811h.c b/drivers/net/phy/air_en8811h.c
index 0eeb7b9a4e26..34d2727e8222 100644
--- a/drivers/net/phy/air_en8811h.c
+++ b/drivers/net/phy/air_en8811h.c
@@ -312,6 +312,12 @@ static int air_write_buf(struct phy_device *phydev, u32 address,
 	int saved_page;
 	int ret = 0;
 
+	if (fw->size % 4) {
+		phydev_err(phydev, "firmware size %zu is not a multiple of 4\n",
+			   fw->size);
+		return -EINVAL;
+	}
+
 	saved_page = phy_select_page(phydev, AIR_PHY_PAGE_EXTENDED_4);
 
 	if (saved_page >= 0) {
-- 
2.53.0

On Wed,  2 Sep 2026 08:05:25 +0000 Aleksei Sviridkin wrote:
> The download loop streams the blob into the MCU as 32-bit words and
> reads the last word past the end of a blob whose size is not a multiple
> of four. The shipped blobs happen to be aligned, so the overread never
> showed; a truncated or foreign file would carry up to three bytes of
> whatever follows it into the MCU. Reject it before the first write
> instead.

When you repost please explain how this was discovered, and tested.

On Wed, Sep 02, 2026 at 08:05:25AM +0000, Aleksei Sviridkin wrote:
> The download loop streams the blob into the MCU as 32-bit words and
> reads the last word past the end of a blob whose size is not a multiple
> of four. The shipped blobs happen to be aligned, so the overread never
> showed; a truncated or foreign file would carry up to three bytes of
> whatever follows it into the MCU. Reject it before the first write
> instead.
> 
> Fixes: 71e79430117d ("net: phy: air_en8811h: Add the Airoha EN8811H PHY driver")
> Assisted-by: LLM
> Signed-off-by: Aleksei Sviridkin <f@lex.la>

Does this bother people?

https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

I think this should be merged via net-next.

Other than that: Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew