1 files changed, 35 insertions, 1 deletions

diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 8fc9af246944..7074989d5f75 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1754,18 +1754,52 @@ static void rtl_writephy_batch(struct rtl8169_private *tp,
 #define PHY_DELAY_MS            0xe0000000
 #define PHY_WRITE_ERI_WORD      0xf0000000
 
+struct fw_info {
+        u32     magic;
+        char    version[RTL_VER_SIZE];
+        __le32  fw_start;
+        __le32  fw_len;
+        u8      chksum;
+} __packed;
+
 #define FW_OPCODE_SIZE  sizeof(typeof(*((struct rtl_fw_phy_action *)0)->code))
 
 static bool rtl_fw_format_ok(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
 {
         const struct firmware *fw = rtl_fw->fw;
+        struct fw_info *fw_info = (struct fw_info *)fw->data;
         struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;
         char *version = rtl_fw->version;
         bool rc = false;
 
         if (fw->size < FW_OPCODE_SIZE)
                 goto out;
-        else {
+
+        if (!fw_info->magic) {
+                size_t i, size, start;
+                u8 checksum = 0;
+
+                if (fw->size < sizeof(*fw_info))
+                        goto out;
+
+                for (i = 0; i < fw->size; i++)
+                        checksum += fw->data[i];
+                if (checksum != 0)
+                        goto out;
+
+                start = le32_to_cpu(fw_info->fw_start);
+                if (start > fw->size)
+                        goto out;
+
+                size = le32_to_cpu(fw_info->fw_len);
+                if (size > (fw->size - start) / FW_OPCODE_SIZE)
+                        goto out;
+
+                memcpy(version, fw_info->version, RTL_VER_SIZE);
+
+                pa->code = (__le32 *)(fw->data + start);
+                pa->size = size;
+        } else {
                 if (fw->size % FW_OPCODE_SIZE)
                         goto out;