From: Lucas <lucasp.linux@gmail.com>

rtl8139_set_mac_address() accesses dev->dev_addr by casting it to u32
pointers. Besides potentially performing unaligned accesses, the second
read starts at offset 4 and reads 32 bits even though only two bytes
remain in the Ethernet address.

Use get_unaligned_le32() and get_unaligned_le16() to read the address
with the appropriate width and endianness. This also fixes the Sparse
type warnings caused by passing __le32 values to iowrite32().

Signed-off-by: Lucas Poupeau <lucasp.linux@gmail.com>
---
 drivers/net/ethernet/realtek/8139too.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index 8241bcf76664..1736599d7244 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -112,6 +112,7 @@
 #include <linux/gfp.h>
 #include <linux/if_vlan.h>
 #include <asm/irq.h>
+#include <linux/unaligned.h>
 
 /* Default Message level */
 #define RTL8139_DEF_MSG_ENABLE   (NETIF_MSG_DRV   | \
@@ -2230,8 +2231,8 @@ static int rtl8139_set_mac_address(struct net_device *dev, void *p)
 	spin_lock_irq(&tp->lock);
 
 	RTL_W8_F(Cfg9346, Cfg9346_Unlock);
-	RTL_W32_F(MAC0 + 0, cpu_to_le32 (*(u32 *) (dev->dev_addr + 0)));
-	RTL_W32_F(MAC0 + 4, cpu_to_le32 (*(u32 *) (dev->dev_addr + 4)));
+	RTL_W32_F(MAC0 + 0, get_unaligned_le32(dev->dev_addr));
+	RTL_W32_F(MAC0 + 4, get_unaligned_le16(dev->dev_addr + 4));
 	RTL_W8_F(Cfg9346, Cfg9346_Lock);
 
 	spin_unlock_irq(&tp->lock);
-- 
2.55.0

On Mon, Aug 24, 2026 at 12:37:09PM +0200, Lucas Poupeau wrote:
> From: Lucas <lucasp.linux@gmail.com>
> 
> rtl8139_set_mac_address() accesses dev->dev_addr by casting it to u32
> pointers. Besides potentially performing unaligned accesses, the second
> read starts at offset 4 and reads 32 bits even though only two bytes
> remain in the Ethernet address.
> 
> Use get_unaligned_le32() and get_unaligned_le16() to read the address
> with the appropriate width and endianness. This also fixes the Sparse
> type warnings caused by passing __le32 values to iowrite32().
> 
> Signed-off-by: Lucas Poupeau <lucasp.linux@gmail.com>

If you are targeting the net tree, you need a Fixes: tag.

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

Does this bother people?

https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

    Andrew

---
pw-bot: cr

Hi Andrew,

After looking into this further, I don't think this warrants a fix for
the net tree. dev->dev_addr is backed by a MAX_ADDR_LEN buffer, so the
second 32-bit read does not actually go out of bounds, and I don't
have a concrete case where the alignment causes a problem.

I'll drop the patch.
Thanks for the review.

Regards,
Lucas


On Mon, Aug 24, 2026 at 4:38 PM Andrew Lunn <andrew@lunn.ch> wrote:
>
> On Mon, Aug 24, 2026 at 12:37:09PM +0200, Lucas Poupeau wrote:
> > From: Lucas <lucasp.linux@gmail.com>
> >
> > rtl8139_set_mac_address() accesses dev->dev_addr by casting it to u32
> > pointers. Besides potentially performing unaligned accesses, the second
> > read starts at offset 4 and reads 32 bits even though only two bytes
> > remain in the Ethernet address.
> >
> > Use get_unaligned_le32() and get_unaligned_le16() to read the address
> > with the appropriate width and endianness. This also fixes the Sparse
> > type warnings caused by passing __le32 values to iowrite32().
> >
> > Signed-off-by: Lucas Poupeau <lucasp.linux@gmail.com>
>
> If you are targeting the net tree, you need a Fixes: tag.
>
> https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html
>
> Does this bother people?
>
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>     Andrew
>
> ---
> pw-bot: cr