Re: [PATCH] fwctl: pds: Validate RPC input size before parsing

[Jason Gunthorpe]

On Sun, May 17, 2026 at 03:22:32PM +0900, Heechan Kang wrote:
> The fwctl core allocates the device-specific RPC input buffer with
> fwctl_rpc.in_len and passes that buffer to the driver callback.
> 
> pdsfc_fw_rpc() casts the buffer to struct fwctl_rpc_pds and then calls
> pdsfc_validate_rpc(), which reads fields from that structure before
> checking that the input buffer is large enough to contain it. A short
> in_len can make pds_fwctl read beyond the allocation.
> 
> Reject pds RPC buffers that are smaller than struct fwctl_rpc_pds before
> parsing any pds-specific fields.
> 
> Fixes: 92c66ee829b9 ("pds_fwctl: add rpc and query support")
> Cc: stable@xxxxxxxxxxxxxxx # v6.15+
> Signed-off-by: Heechan Kang <gganji11@xxxxxxxxx>
> ---
>  drivers/fwctl/pds/main.c | 3 +++
>  1 file changed, 3 insertions(+)

Applied to for-rc, thanks

Jason