ne2k_pci_block_output() handles residual bytes after the main outsl()
loop when the transfer count is not a multiple of 4. It correctly
handles the 2-byte residual case with outw(),  but is missingg the
1 byte residual case. This means for packets where count % 4 == 1 or
count % 4 == 3,  the final byte is never written to the NIC's data
port.

In practice, this is masked by the count being rounded up to a 4-byte
boundary earlier in the function for ONLY_32BIT_IO cards, but that
rounding itself causes a little information leak by sending
uninitialized kernel buffer bytes on the wire

Add the missing outb() call for the odd byte case, mirroring what
ne2k_pci_block_input() already does correctly.

Signed-off-by: Titouan Ameline de Cadeville <titouan.ameline@gmail.com>
---
 drivers/net/ethernet/8390/ne2k-pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/8390/ne2k-pci.c b/drivers/net/ethernet/8390/ne2k-pci.c
index 1a34da07c0db..1bd5b94b5d22 100644
--- a/drivers/net/ethernet/8390/ne2k-pci.c
+++ b/drivers/net/ethernet/8390/ne2k-pci.c
@@ -632,6 +632,8 @@ static void ne2k_pci_block_output(struct net_device *dev, int count,
 				outw(le16_to_cpu(*b++), NE_BASE + NE_DATAPORT);
 				buf = (char *)b;
 			}
+			if (count & 1)
+				outb(*buf, NE_BASE + NE_DATAPORT);
 		}
 	}
 
-- 
2.44.2

On Tue, Apr 21, 2026 at 04:57:36PM +0200, Titouan Ameline de Cadeville wrote:
> ne2k_pci_block_output() handles residual bytes after the main outsl()
> loop when the transfer count is not a multiple of 4. It correctly
> handles the 2-byte residual case with outw(),  but is missingg the
> 1 byte residual case. This means for packets where count % 4 == 1 or
> count % 4 == 3,  the final byte is never written to the NIC's data
> port.
> 
> In practice, this is masked by the count being rounded up to a 4-byte
> boundary earlier in the function for ONLY_32BIT_IO cards, but that
> rounding itself causes a little information leak by sending
> uninitialized kernel buffer bytes on the wire

It seems to me that the code being updated by this patch is for
!ONLY_32BIT_IO cards. And in that case count is rounded up to
the next even value if it is odd.

	if (ei_status.ne2k_flags & ONLY_32BIT_IO)
			count = (count + 3) & 0xFFFC;
		else
			if (count & 0x01)
				count++;


Regarding the information leak. I believe this is only from
the Kernel to the device. But not from the device onto the wire
as the device doesn't send data beyond the end of the packet data.

It isn't at obvious to me that this is a problem that warrants fixing.

> 
> Add the missing outb() call for the odd byte case, mirroring what
> ne2k_pci_block_input() already does correctly.
> 
> Signed-off-by: Titouan Ameline de Cadeville <titouan.ameline@gmail.com>
> ---
>  drivers/net/ethernet/8390/ne2k-pci.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/8390/ne2k-pci.c b/drivers/net/ethernet/8390/ne2k-pci.c
> index 1a34da07c0db..1bd5b94b5d22 100644
> --- a/drivers/net/ethernet/8390/ne2k-pci.c
> +++ b/drivers/net/ethernet/8390/ne2k-pci.c
> @@ -632,6 +632,8 @@ static void ne2k_pci_block_output(struct net_device *dev, int count,
>  				outw(le16_to_cpu(*b++), NE_BASE + NE_DATAPORT);
>  				buf = (char *)b;
>  			}
> +			if (count & 1)
> +				outb(*buf, NE_BASE + NE_DATAPORT);

Because count is even this condition will never be met.

>  		}
>  	}

-- 
pw-bot: changes-requested