From nobody Mon Apr 6 18:23:59 2026 Received: from mail.amicon.ru (unknown [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F56A3B4E9E; Wed, 18 Mar 2026 12:20:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773836448; cv=none; b=aF/FNobbXNlKyrVJ4pfRyWxySKu/e2MXZhS0ABSKKD81NdJcodirKUGQOqwA/i/1HlR8gFyIs/PzsdgB9sD4yO/NDhzIfT1VO3kapS98MqeBBPzQM76BwpWnVFIN9Lo0cNnNzMJja6QLJe6Nn/akKyQS6xCvi0ckN/mRhc4OuSo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773836448; c=relaxed/simple; bh=NCdVk5JWan7K37ZYtd4B8iDcavDP/jrJcBFFkGLlPxo=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=KFfPThQhjvvXIkE5IYw7XKVMJNMOxOR3H3Ar1vMwsPJTn3mtV7Qw7IwiNMmf8WniXCBM/NbxSIZtG0IuT90Ime1F66wVO/4OfC1ygCp60cvmhXyClACRnmjmd+5xc/z+lJvYKvkqdjJnHSMPzGwOpzSaR1YLRBsr+6CIj280K3A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=ZFMFN/hk; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="ZFMFN/hk" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1773835531; h=from:subject:to:date:message-id; bh=NCdVk5JWan7K37ZYtd4B8iDcavDP/jrJcBFFkGLlPxo=; b=ZFMFN/hkDIuh7B/avjZjAbP6GIxBh5sDQ57pwC/l97HXIxa9eRmYXOEymnyEcEApzSmIlGlNHqX iEM4FefnNMGYdf+CEPUFsSuZir1fRnrgxoyPuLC/y9O7pELteypUxTFcxfB/GolcGVDzbm71oPkRu iC4BxLLyBdQW3/IKhkv4ANv1QNVa3x9/YjTwJQ8h9Sm0aqnTLyQeqbrbFfsaZlJNxCR7PK1lR6b7W fZXsFqPUnlotTlW5PYKlybpM0TwAmQ3u0ocFRbyQtgaASP6LEF0xiWXEi0sfeY/JWcYIOZuUC5IrX ow1gC2yH/Jqei4A4ZiTWmafGiqHZm2zFfc2g== Received: from example.com (172.16.2.46) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Wed, 18 Mar 2026 15:05:31 +0300 From: Agalakov Daniil To: Tony Nguyen CC: Agalakov Daniil , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , "Jakub Kicinski" , Paolo Abeni , , , , , "Daniil Iskhakov" , Roman Razov Subject: [PATCH net 1/3] e1000: check return value of e1000_read_eeprom Date: Wed, 18 Mar 2026 15:05:05 +0300 Message-ID: <20260318120512.687149-2-ade@amicon.ru> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260318120512.687149-1-ade@amicon.ru> References: <20260318120512.687149-1-ade@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" [Why] e1000_set_eeprom() performs a read-modify-write operation when the write range is not word-aligned. This requires reading the first and last words of the range from the EEPROM to preserve the unmodified bytes. However, the code does not check the return value of e1000_read_eeprom(). If the read fails, the operation continues using uninitialized data from eeprom_buff. This results in corrupted data being written back to the EEPROM for the boundary words. Add the missing error checks and abort the operation if reading fails. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil Reviewed-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net= /ethernet/intel/e1000/e1000_ethtool.c index ab232b3fbbd0..4dcbeabb3ad2 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c @@ -496,14 +496,19 @@ static int e1000_set_eeprom(struct net_device *netdev, */ ret_val =3D e1000_read_eeprom(hw, first_word, 1, &eeprom_buff[0]); + if (ret_val) + goto out; + ptr++; } - if (((eeprom->offset + eeprom->len) & 1) && (ret_val =3D=3D 0)) { + if ((eeprom->offset + eeprom->len) & 1) { /* need read/modify/write of last changed EEPROM word * only the first byte of the word is being modified */ ret_val =3D e1000_read_eeprom(hw, last_word, 1, &eeprom_buff[last_word - first_word]); + if (ret_val) + goto out; } =20 /* Device's eeprom is always little-endian, word addressable */ @@ -522,6 +527,7 @@ static int e1000_set_eeprom(struct net_device *netdev, if ((ret_val =3D=3D 0) && (first_word <=3D EEPROM_CHECKSUM_REG)) e1000_update_eeprom_checksum(hw); =20 +out: kfree(eeprom_buff); return ret_val; } --=20 2.51.0 From nobody Mon Apr 6 18:23:59 2026 Received: from mail.amicon.ru (unknown [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 054A13D6477; Wed, 18 Mar 2026 12:20:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773836450; cv=none; b=SUMqQlyYftqZdx1mjg+k6uww+hyTI3YZllwhVGigP/Atoav6HCZycByH7lpW+qRNSiyTheRtWCcYCvChyba2lp7c7jB/p2v+uy64/9oEHl7EQpHfFSmxZoNinZOF/5adogIytTSKtLM7lyOEDK3W/3x1Qi6URo97dtbgXPu7zG4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773836450; c=relaxed/simple; bh=FoSSaZkWU4aJKqM+so78vjgnK78tTSzmvnGZvUsq3j0=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=Hhc1IjGkkScp43S48/gCTP9TATU20nAbs0m+Bv1efts4x0bq1BNnKz/6CStSPNZiandTdEPWnSGDR89SzvkWKTqVBNA2lXN7vKokjH2U7F74ZQ9xVDhXlZNdF4FhyDMfrjK6EVtiu7VmodIwv0Ofyireb0F29TManAK85c+KvR4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=OBfSutDD; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="OBfSutDD" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1773835531; h=from:subject:to:date:message-id; bh=FoSSaZkWU4aJKqM+so78vjgnK78tTSzmvnGZvUsq3j0=; b=OBfSutDDrJdxlH6acMftdt2KV3G3Tz6vWGCJDGwIIz2s4xByTxY+vrE7MVE0M1mtc7pCU7M+Gyy gfElYqSpGpddQ6fJuHOfNattmfWVmaN4VdoZh38RpyOQEiYbIScYw6IAUFvCslxOqLgRT+n7AyjVp PgU4+nE6sVVHnZzIstEb/1vFnGoKb1Tzk0vpNfS5lzvIAgj2XOOouJvnm/WuVcRff09LxY0FbSd/C vCIUCaDO+Oj0hNyyQQrvc8DOT4vkMA2rcwmcHpnNmrQf5bubLvVO6mzunE+1CAgn1fUi6J/JU1aUx zhpiOpxqTV19J0O4Emz9R5hWi+5T2xljUTcw== Received: from example.com (172.16.2.46) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Wed, 18 Mar 2026 15:05:31 +0300 From: Agalakov Daniil To: Tony Nguyen CC: Agalakov Daniil , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , "Jakub Kicinski" , Paolo Abeni , , , , , "Daniil Iskhakov" , Roman Razov Subject: [PATCH net 2/3] e1000: fix endianness conversion of uninitialized words Date: Wed, 18 Mar 2026 15:05:06 +0300 Message-ID: <20260318120512.687149-3-ade@amicon.ru> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260318120512.687149-1-ade@amicon.ru> References: <20260318120512.687149-1-ade@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" [Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil Reviewed-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net= /ethernet/intel/e1000/e1000_ethtool.c index 4dcbeabb3ad2..c15ad95c63c1 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c @@ -499,6 +499,9 @@ static int e1000_set_eeprom(struct net_device *netdev, if (ret_val) goto out; =20 + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[0]); + ptr++; } if ((eeprom->offset + eeprom->len) & 1) { @@ -509,11 +512,10 @@ static int e1000_set_eeprom(struct net_device *netdev, &eeprom_buff[last_word - first_word]); if (ret_val) goto out; - } =20 - /* Device's eeprom is always little-endian, word addressable */ - for (i =3D 0; i < last_word - first_word + 1; i++) - le16_to_cpus(&eeprom_buff[i]); + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[last_word - first_word]); + } =20 memcpy(ptr, bytes, eeprom->len); =20 --=20 2.51.0 From nobody Mon Apr 6 18:23:59 2026 Received: from mail.amicon.ru (unknown [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3D3A3D6493; Wed, 18 Mar 2026 12:20:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773836452; cv=none; b=NV3uFhM9yu/uYwmQsSXmf5yOBNvdxlOwaRhfOxdDq+8A64Ii/98SEJp6NyMJpUBPu/OJhrP06lgf3hBgY2lVrzr1glMPB+zn9hj6SzV6DoCyek0edZHteoq/xsgxAHFttH64UBUquF/gqrfTfAgLuo5gvNCpEvSNsHKjodjwWtY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773836452; c=relaxed/simple; bh=XZen40Yk+QoMIT6s4hnv4GEbtv6HyjqcTqgr8GMETfI=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=sTaNS5cI7XM+uW5VyUXhphhTTdoNCjDeaRAcT8TFuRfSNd1iyyj34BCaXLGb30qWAPwc2MaN1ycgzxBeC393Tk/zYR19SmMQAfX/HERIfdOjfFUSuWe3lrIvX7v1VYmEiWah24wLU5MGGZYoPYvnYQoapmaA1oeJNzx3fIjD0Ig= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=KarlrZZH; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="KarlrZZH" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1773835531; h=from:subject:to:date:message-id; bh=XZen40Yk+QoMIT6s4hnv4GEbtv6HyjqcTqgr8GMETfI=; b=KarlrZZHrsoqSVRJAFH0BUR8rZgVSwlvrDy97U52GJXk15tmNkczjrtdFai1urFpF38fGgSGoLq OAnjIUpfI4Lq4gEK+D2g/C18jZ4LYIsnS7A0cnjUQlzhaSvOy4t3+yMDx/OZHAVwVMMRYVLzmGz0F 8tLGyj9tcebnFFyc402qWvT8Z0+GFFPQNcNt5yShTF7W3tWBDxOi2U9Im89o2jmGlU3FbiTVAHRmb MnXaUzgwadhBUY1Is9YVmQKTmSXWhCqBMH+/d8zCUF8EtKAKXQhIaQBtLcNgnJsnIIA1yWpZMyB1I OTK/D+yOr5uT6FYggJyw/tnJUKYjpekPAr1w== Received: from example.com (172.16.2.46) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Wed, 18 Mar 2026 15:05:31 +0300 From: Agalakov Daniil To: Tony Nguyen CC: Agalakov Daniil , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , "Jakub Kicinski" , Paolo Abeni , , , , , "Daniil Iskhakov" , Roman Razov Subject: [PATCH net 3/3] e1000e: fix endianness conversion of uninitialized words Date: Wed, 18 Mar 2026 15:05:07 +0300 Message-ID: <20260318120512.687149-4-ade@amicon.ru> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260318120512.687149-1-ade@amicon.ru> References: <20260318120512.687149-1-ade@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" [Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil Reviewed-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/e1000e/ethtool.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethe= rnet/intel/e1000e/ethtool.c index dbed30943ef4..a8b35ae41141 100644 --- a/drivers/net/ethernet/intel/e1000e/ethtool.c +++ b/drivers/net/ethernet/intel/e1000e/ethtool.c @@ -583,20 +583,25 @@ static int e1000_set_eeprom(struct net_device *netdev, /* need read/modify/write of first changed EEPROM word */ /* only the second byte of the word is being modified */ ret_val =3D e1000_read_nvm(hw, first_word, 1, &eeprom_buff[0]); + if (ret_val) + goto out; + + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[0]); + ptr++; } - if (((eeprom->offset + eeprom->len) & 1) && (!ret_val)) + if ((eeprom->offset + eeprom->len) & 1) { /* need read/modify/write of last changed EEPROM word */ /* only the first byte of the word is being modified */ ret_val =3D e1000_read_nvm(hw, last_word, 1, &eeprom_buff[last_word - first_word]); + if (ret_val) + goto out; =20 - if (ret_val) - goto out; - - /* Device's eeprom is always little-endian, word addressable */ - for (i =3D 0; i < last_word - first_word + 1; i++) - le16_to_cpus(&eeprom_buff[i]); + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[last_word - first_word]); + } =20 memcpy(ptr, bytes, eeprom->len); =20 --=20 2.51.0