ihex: Fix 16 bit truncation in ihex_binrec_size()

ihex_binrec_size() returns uint16_t while computing be16_to_cpu(p->len) + sizeof(struct ihex_binrec), so record lengths of 65530 and above wrap. __ihex_next_binrec() uses the result as the offset to the next record. A length of 65530 gives an advance of zero, so ihex_validate_fw() spins on the same record forever. Lengths of 65531 to 65535 advance by 4 or 8 instead of 65544, so a 14 byte image passes validation while its first record claims 65535 bytes of payload. emi26_load_firmware() passes it to emi26_writememory(), which kmemdup()s 65535 bytes out of a 14 byte buffer producing the following splat:

  BUG: KASAN: vmalloc-out-of-bounds in kmemdup_noprof+0x3b/0x50
  Read of size 65535 at addr ffffc90000075006 by task kworker/11:1/174
  Workqueue: usb_hub_wq hub_event
  Call Trace:
   <TASK>
   kasan_check_range+0x10f/0x1e0
   __asan_memcpy+0x23/0x60
   kmemdup_noprof+0x3b/0x50
   emi26_writememory+0x29/0xd0
   emi26_probe+0x2d1/0xb64

Return uint32_t so neither the addition nor the following ALIGN() can wrap.

---
Changes in v2:
- return uint32_t rather than size_t (Greg)
- drop Cc: stable
- Link to v1: https://patch.msgid.link/[email protected]

---
 include/linux/ihex.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index b824877e6d1b..04be83fb0d62 100644
@@ -21,7 +21,7 @@ struct ihex_binrec {
 	uint8_t data[];
 } __attribute__((packed));
 
-static inline uint16_t ihex_binrec_size(const struct ihex_binrec *p)
+static inline uint32_t ihex_binrec_size(const struct ihex_binrec *p)
 {
 	return be16_to_cpu(p->len) + sizeof(*p);
 }

---
base-commit: 89a312991dc6e638a36adc43ccb91dbc25504c04
change-id: 20260902-ihex-62b68b7e2bae

Best regards,

Vasileios Almpanis <[email protected]>