nfp: reject truncated hwinfo table

hwinfo_db_validate() only bounds db->size from above, so a firmware table advertising size < sizeof(*db) + sizeof(u32) makes the following "size -= sizeof(u32)" underflow and crc32_posix() read far out of bounds. Reject such tables before the subtraction.

---
 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_hwinfo.c | 5 +++++
 1 file changed, 5 insertions(+)

index cfa4db5d3f85..30aad12fd062 100644
@@ -136,6 +136,11 @@ hwinfo_db_validate(struct nfp_cpp *cpp, struct nfp_hwinfo *db, u32 len)
 		return -EINVAL;
 	}
 
+	if (size < sizeof(*db) + sizeof(u32)) {
+		nfp_err(cpp, "Truncated hwinfo table, size %u\n", size);
+		return -EINVAL;
+	}
+
 	size -= sizeof(u32);
 	crc = crc32_posix(db, size);
 	if (crc != get_unaligned_le32(db->start + size)) {

2.55.0

AFAIU it's okay to assume that PCIe devices are not malicious Let's not waste time with these sort of "fixes"

pw-bot: reject