From nobody Tue Sep 29 13:20:31 2026 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88029339B41 for ; Fri, 7 Aug 2026 14:56:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786114603; cv=none; b=cy+TylQxiBer1n3c5tzNm+1H5vPbmU1XDopruITUlCdTyBJakhVG8OGOIHvkj7hkkSW8tR9fKirZuEmINFjj0e/0jEBEgP9T2G3HZN5VRTO1jkc3zK1AlNtGHs1IdGGDz/K01+rRuaS4beOGvySy16IvsXlQXGyeot1BWMU0vXY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786114603; c=relaxed/simple; bh=6pZaueqtoT6Ccmkb7FvNWDYQFHPNGGZFwXSoCh5+d4s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Xj4xK6frfpKQpl37uEvZJeC3GbAvDqgWi50lk7OgFSjnnFmF45fYfP3bLJjsNPHk8AYUivYKJyFmEGc4li4aG7mYC3iH8eTHtoYDPhPNDPfcvYbWFtaL33sCVJmgrPjd5afNX3V11rRV641SLjskJQ2LmquJS896QPmmhhz/M/o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SbMJRz4Y; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SbMJRz4Y" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-cbb85186d43so1910554a12.3 for ; Fri, 07 Aug 2026 07:56:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786114597; x=1786719397; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=tkpFr6rG5lBoCbq0wNytvjoTRlryXvJyiJH9uY9WWYY=; b=SbMJRz4YQEkjob1b+jPNpOj93PmzJsMdbRlZXlUF6VkcM/JRdyWrkLOANvGuFIcpl6 S5U6t+XhQw49fhNo1YrncwTtmrDa50gzCvVyzmXqK6Jlf61cEsjB+3exMpm3gGP5kEqb da5cmD7IliG4NCnwbxFM9/IT8/Mj1KflHmgngXC+x//JQ285YKn98SLfoXCZyeVlDLFs 6h1/Y/vTMljvNXvFKebz7x/DaKsX0TysS3jEKqcKe0Iv4ZFHYQuy64PykpGGPNJUkzcO Svcy5s3wluGpFSfkEIppwdWCWZi0XaF7uq1zMWXI8ekmC5o1tmKsysanoWTXGYuA0YSw kTEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786114597; x=1786719397; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tkpFr6rG5lBoCbq0wNytvjoTRlryXvJyiJH9uY9WWYY=; b=KNHwuDzVacAi7dv8M0iwhGsapKsHxtfR54vscwCk/SGE26j2mlucR2qefK1z0PYDLp 5FLu2vr4v+vXzno6zxhD9dgcT/fr/ni/iOJaSg4fejd58z5KxKG7wVX1cNOVgRwNikBI 2JgI+EKg5RRZpP1DLCfbWWbJLPcRt5XNrx/0zkrT4UJpQBlJqQmjvfFV3NsqSVDZTdZx VO4FLWUBo16O9DqZQCS+Pmg9LZ/OhXTceRDRxO9Fzv42DnzGITPS9DJ5vr7gnJFM8XqA 9wCV3Jh0NsIFqgZgKropqQmiTvakO5D0XsBSCIx8IszFIXOIBzE/BYj+Oc+9w7OAyE8X mlTw== X-Forwarded-Encrypted: i=1; AHgh+RqdAFHnsTofvgmkfbRHoX/bU+TniRv9oNj1rZ6FO70PsMDQeAYcqhXPge2Yxc5SHv83msStMZr52JS8i9A=@vger.kernel.org X-Gm-Message-State: AOJu0Yxtp55IjJ//tY0pfVtZ/CQCyvIJAFGUpA2d4p6wyYEJR7P0tUm/ ttbsthom2AhVr605nLpEiv7y5fuhGwkZbuipQLXcxy+RPc3GawzKv1yF X-Gm-Gg: AR+sD10IW9wRZq78lNUjI6vBcYwOncHkFdvWy0VcYA4XHTR2VQXkLZJSVy3fH1cbyj3 XC1A0X5kGHkfYYQP7WfhNg4dYh7cCqHKbzm4NaiZD2Ir12X5Zgs/LLRN3DN2PH0zIrIufjevkfz m4BcRpT60UXoCjK20fyHfjUmyX47ZukPJvXe+g6rU+tqjtNXXynjdH9hlAjThd87ztp6JazZPlQ oIU1MATnzO1rzu1qceuO/yS/hTgmJsJq+R7sr/wzRBxClkNhfUYqi8tZcqQi9rRMak82P+rJKAz Sr/bA1eCFpLSpCI9UB06YxUADdjvxfvUGimbE0115sE9L6XEQ0DPnoO0SINwmwZi3V9wd8LUSfm mAqC8jzGS/L/EQwroxWr3iaTqVQjQW+NH9kEHBgEo87Z9SngVPxOnergVWus5QsHkWup2+vuwnG FGLQ4J9O7MAxGGRIEEI4EDxklsJ1QdG/GYdPvOFujdajeeCrVUC0Bs4N9cLjxNUnCZpRc= X-Received: by 2002:a05:6a20:a11a:b0:3cb:8eb2:acbd with SMTP id adf61e73a8af0-3cbce9294abmr977283637.25.1786114596980; Fri, 07 Aug 2026 07:56:36 -0700 (PDT) Received: from user.. ([2405:201:c052:b00b:782d:6a3f:587:95d7]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141019c3912sm11957018c88.8.2026.08.07.07.56.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 07:56:36 -0700 (PDT) From: pavankumaryalagada@gmail.com To: intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org Cc: anthony.l.nguyen@intel.com, przemyslaw.kitszel@intel.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, pavankumaryalagada@gmail.com, syzbot+e0abb1d45ac291ebebeb@syzkaller.appspotmail.com Subject: [PATCH] e100: prevent shift out-of-bounds in e100_eeprom_load Date: Fri, 7 Aug 2026 20:26:26 +0530 Message-ID: <20260807145626.52692-1-pavankumaryalagada@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yalagada Pavan Kumar When reading the EEPROM address length, e100_eeprom_read() can return an invalid length (0 or >=3D 16). Passing an invalid addr_len to bit-shift operations causes a shift out-of-bounds, triggering a kernel panic or UBSAN warning. Validate addr_len after reading it from EEPROM and return -EINVAL if the value is out of bounds. Additionally, use 1U to prevent signed integer overflow when calculating eeprom_wc. Reported-by: syzbot+e0abb1d45ac291ebebeb@syzkaller.appspotmail.com Tested-by: syzbot+e0abb1d45ac291ebebeb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3De0abb1d45ac291ebebeb Signed-off-by: Yalagada Pavan Kumar --- Tested using syzbot c reproducer. --- drivers/net/ethernet/intel/e100.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel= /e100.c index 29960762e64a..1de5cd41ea0c 100644 --- a/drivers/net/ethernet/intel/e100.c +++ b/drivers/net/ethernet/intel/e100.c @@ -744,7 +744,12 @@ static __le16 e100_eeprom_read(struct nic *nic, u16 *a= ddr_len, u16 addr) * complete address. Use this to adjust addr_len. */ ctrl =3D ioread8(&nic->csr->eeprom_ctrl_lo); if (!(ctrl & eedo) && i > 16) { - *addr_len -=3D (i - 16); + u16 len =3D i - 16; + + if (len > *addr_len) + *addr_len =3D 0; + else + *addr_len -=3D len; i =3D 17; } =20 @@ -765,7 +770,15 @@ static int e100_eeprom_load(struct nic *nic) =20 /* Try reading with an 8-bit addr len to discover actual addr len */ e100_eeprom_read(nic, &addr_len, 0); - nic->eeprom_wc =3D 1 << addr_len; + + if (!addr_len || addr_len >=3D 16) { + netif_err(nic, probe, nic->netdev, + "Invalid EEPROM address length %u\n", + addr_len); + return -EINVAL; + } + + nic->eeprom_wc =3D 1U << addr_len; =20 for (addr =3D 0; addr < nic->eeprom_wc; addr++) { nic->eeprom[addr] =3D e100_eeprom_read(nic, &addr_len, addr); --=20 2.43.0