From nobody Wed Apr 1 22:00:05 2026 Received: from mail.amicon.ru (mail.amicon.ru [77.108.111.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 898003FEB1D; Wed, 1 Apr 2026 12:09:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=77.108.111.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775045395; cv=none; b=U1fbj9oP1+8r6jinC0w7Wc3QQNWlR9qvl1fG01ram8aW0FNiPJyYvUCySyOfd8WpI0JsoH4QtZUE/hhz5KfoKJaEyuatHOphEFEHC2XTCOCQM9GiDhWPhwr+R2Dwzo3+aDrlFCPhGgFdir72a2dSzv0sJrVV+pjZefzqhp+Chro= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775045395; c=relaxed/simple; bh=d7GuwT6Jl1KQtz7eotNRQp6Eo286Tux6gD8IH2Y6PeY=; h=Content-Type:From:To:CC:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version; b=O9LlU+yfc/KDCBK82woQt6Y2i1cguanSU2GDgSgJMPCzTm5SOMJTW1mWxnFNWfFDEoeOgYwf/J7l4FaM5j0vdss3RT5J5e2sG95/vm8G+4rojqddCtaXDEYHTLW2M/djBMkOl2GcbMbx2ZFLBN4Uo7wCwpteq3oiKIFo/wFDj/o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru; spf=pass smtp.mailfrom=amicon.ru; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b=eRemQYHB; arc=none smtp.client-ip=77.108.111.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amicon.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amicon.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amicon.ru header.i=@amicon.ru header.b="eRemQYHB" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; d=amicon.ru; s=mail; c=simple/simple; t=1775045378; h=from:subject:to:date:message-id; bh=d7GuwT6Jl1KQtz7eotNRQp6Eo286Tux6gD8IH2Y6PeY=; b=eRemQYHB779uyNY7U10z6sTwbZOkk3cqeASFZGOdut2qCgujhTL6eTZJl4jXBD/m79nNZwZ+RQH h1szsSisywG3l6GEydnjLtk2borwwAPVz77zqhfEB373MFggnQzgytiD70v7h1gb3X/LbeK4nbLE7 xo3LDm1Xw8qjRoWoOIXSxuvq8PD0mFox5i7SF5dclGGuF3/33PafSSuy4EMUVg1GxuMUcq3jCljXS w4Rw7mNPjjaKj5YJH1XK8G7/FD76KTdtsiv3eD/jBsUfog7apH9Y+CM42Es+17Jr0wHQ//m2tlISt A5zY8rW7JQ5EX+1pj8kqDaTxnhFEnqynmzBg== Received: from example.com (172.16.2.46) by mail.amicon.lan (192.168.0.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.27; Wed, 1 Apr 2026 15:09:38 +0300 From: Agalakov Daniil To: Tony Nguyen CC: Agalakov Daniil , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , "Jakub Kicinski" , Paolo Abeni , , , , , "Daniil Iskhakov" , Roman Razov Subject: [PATCH net-next v3 2/2] e1000e: limit endianness conversion to boundary words Date: Wed, 1 Apr 2026 15:08:24 +0300 Message-ID: <20260401120919.282668-3-ade@amicon.ru> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260401120919.282668-1-ade@amicon.ru> References: <20260325151615.1407182-1-ade@amicon.ru> <20260401120919.282668-1-ade@amicon.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: mail.amicon.lan (192.168.0.59) To mail.amicon.lan (192.168.0.59) Content-Type: text/plain; charset="utf-8" [Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil --- v3: - Reverted to v1's "check-then-convert" logic: the return value of e1000_read_nvm() is now checked before performing le16_to_cpus(). - Removed the redundant full-buffer loops that caused double endianness conversion in v2. v2: - Split from the original bugfix series and targeted at 'net-next'. - Removed the Fixes: tag; limiting the conversion scope is an improvement to avoid unnecessary processing of uninitialized memory. - Improved commit description for clarity. - Note on e1000e: this driver already contains the necessary return value checks for EEPROM reads, so only the endianness conversion cleanup is included for e1000e. drivers/net/ethernet/intel/e1000e/ethtool.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethe= rnet/intel/e1000e/ethtool.c index dbed30943ef4..a8b35ae41141 100644 --- a/drivers/net/ethernet/intel/e1000e/ethtool.c +++ b/drivers/net/ethernet/intel/e1000e/ethtool.c @@ -583,20 +583,25 @@ static int e1000_set_eeprom(struct net_device *netdev, /* need read/modify/write of first changed EEPROM word */ /* only the second byte of the word is being modified */ ret_val =3D e1000_read_nvm(hw, first_word, 1, &eeprom_buff[0]); + if (ret_val) + goto out; + + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[0]); + ptr++; } - if (((eeprom->offset + eeprom->len) & 1) && (!ret_val)) + if ((eeprom->offset + eeprom->len) & 1) { /* need read/modify/write of last changed EEPROM word */ /* only the first byte of the word is being modified */ ret_val =3D e1000_read_nvm(hw, last_word, 1, &eeprom_buff[last_word - first_word]); + if (ret_val) + goto out; =20 - if (ret_val) - goto out; - - /* Device's eeprom is always little-endian, word addressable */ - for (i =3D 0; i < last_word - first_word + 1; i++) - le16_to_cpus(&eeprom_buff[i]); + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[last_word - first_word]); + } =20 memcpy(ptr, bytes, eeprom->len); =20 --=20 2.51.0