hwinfo_db_validate() only bounds db->size from above, so a firmware
table advertising size < sizeof(*db) + sizeof(u32) makes the following
"size -= sizeof(u32)" underflow and crc32_posix() read far out of
bounds. Reject such tables before the subtraction.

Fixes: 59a8474888e9 ("nfp: add hwinfo support")
Assisted-by: Claude Opus 5 (Anthropic)
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c
index cfa4db5d3f85..30aad12fd062 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c
@@ -136,6 +136,11 @@ hwinfo_db_validate(struct nfp_cpp *cpp, struct nfp_hwinfo *db, u32 len)
 		return -EINVAL;
 	}
 
+	if (size < sizeof(*db) + sizeof(u32)) {
+		nfp_err(cpp, "Truncated hwinfo table, size %u\n", size);
+		return -EINVAL;
+	}
+
 	size -= sizeof(u32);
 	crc = crc32_posix(db, size);
 	if (crc != get_unaligned_le32(db->start + size)) {
-- 
2.55.0

On Tue,  8 Sep 2026 01:54:37 +0100 David Carlier wrote:
> hwinfo_db_validate() only bounds db->size from above, so a firmware
> table advertising size < sizeof(*db) + sizeof(u32) makes the following
> "size -= sizeof(u32)" underflow and crc32_posix() read far out of
> bounds. Reject such tables before the subtraction.

AFAIU it's okay to assume that PCIe devices are not malicious
Let's not waste time with these sort of "fixes"
-- 
pw-bot: reject