Re: [PATCH] net/ixgbe: fix null dereference on EEPROM write for E610

Re: [PATCH] net/ixgbe: fix null dereference on EEPROM write for E610

[Bruce Richardson]

On Mon, Sep 28, 2026 at 12:50:54PM -0400, Sandeep Penigalapati wrote:
> E610 does not support EEPROM writes and leaves eeprom.ops.write_buffer
> as NULL. ixgbe_set_eeprom() calls this pointer without checking it,
> causing a NULL pointer dereference when a set-eeprom request is issued
> on an E610 port.
> 
> Check the op for NULL and return -ENOTSUP instead.
> 
> Fixes: 316637762a5f ("net/ixgbe/base: enable E610 device")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
> ---
>  drivers/net/intel/ixgbe/ixgbe_ethdev.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
> index 78e19f94c0..c653951858 100644
> --- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
> +++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
> @@ -7370,6 +7370,9 @@ ixgbe_set_eeprom(struct rte_eth_dev *dev,
>  
>  	in_eeprom->magic = hw->vendor_id | (hw->device_id << 16);
>  
> +	if (eeprom->ops.write_buffer == NULL)
> +		return -ENOTSUP;
> +
>  	return eeprom->ops.write_buffer(hw,  first, length, data);

Fix looks correct.

However, I think that the check might be better moved up the function. I
would suggest putting this check right after the secondary process check,
and before the arg validation checks. I don't see any point in checking
args for something that we cannot do anyway, so on bad args to E610, I
think ENOTSUP is a better error code than EINVAL, since it's not going to
work even if the args are fixed.

>  }
>  
> -- 
> 2.27.0
> 

Re: [PATCH v2] net/ixgbe: fix null dereference on EEPROM write for E610

[Bruce Richardson]

On Mon, Sep 28, 2026 at 04:12:53PM -0400, Sandeep Penigalapati wrote:
> E610 does not support EEPROM writes and leaves eeprom.ops.write_buffer
> as NULL. ixgbe_set_eeprom() calls this pointer without checking it,
> causing a NULL pointer dereference when a set-eeprom request is issued
> on an E610 port.
> 
> Check the op for NULL and return -ENOTSUP instead.
> 
> Fixes: 316637762a5f ("net/ixgbe/base: enable E610 device")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> ---
> v2:
>  - Moved the NULL check before the argument validation so an
>    unsupported request returns -ENOTSUP instead of -EINVAL.
> 
>  drivers/net/intel/ixgbe/ixgbe_ethdev.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
> index 78e19f94c0..b7b2b92e3c 100644
> --- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
> +++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
> @@ -7362,6 +7362,9 @@ ixgbe_set_eeprom(struct rte_eth_dev *dev,
>  	if (rte_eal_process_type() != RTE_PROC_PRIMARY)
>  		return -E_RTE_SECONDARY;
>  
> +	if (eeprom->ops.write_buffer == NULL)
> +		return -ENOTSUP;
> +
>  	first = in_eeprom->offset >> 1;
>  	length = in_eeprom->length >> 1;
>  	if ((first > hw->eeprom.word_size) ||
> -- 
> 2.27.0
> 

Re: [PATCH v2] net/ixgbe: fix null dereference on EEPROM write for E610

[Bruce Richardson]

On Mon, Sep 28, 2026 at 02:14:11PM +0100, Bruce Richardson wrote:
> On Mon, Sep 28, 2026 at 04:12:53PM -0400, Sandeep Penigalapati wrote:
> > E610 does not support EEPROM writes and leaves eeprom.ops.write_buffer
> > as NULL. ixgbe_set_eeprom() calls this pointer without checking it,
> > causing a NULL pointer dereference when a set-eeprom request is issued
> > on an E610 port.
> > 
> > Check the op for NULL and return -ENOTSUP instead.
> > 
> > Fixes: 316637762a5f ("net/ixgbe/base: enable E610 device")
> > Cc: stable@dpdk.org
> > 
> > Signed-off-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> > ---

Applied to dpdk-next-net-intel.
Thanks,
/Bruce

[PATCH] net/ixgbe: fix null dereference on EEPROM write for E610

[Sandeep Penigalapati]

E610 does not support EEPROM writes and leaves eeprom.ops.write_buffer
as NULL. ixgbe_set_eeprom() calls this pointer without checking it,
causing a NULL pointer dereference when a set-eeprom request is issued
on an E610 port.

Check the op for NULL and return -ENOTSUP instead.

Fixes: 316637762a5f ("net/ixgbe/base: enable E610 device")
Cc: stable@dpdk.org

Signed-off-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
---
 drivers/net/intel/ixgbe/ixgbe_ethdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
index 78e19f94c0..c653951858 100644
--- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
+++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
@@ -7370,6 +7370,9 @@ ixgbe_set_eeprom(struct rte_eth_dev *dev,
 
 	in_eeprom->magic = hw->vendor_id | (hw->device_id << 16);
 
+	if (eeprom->ops.write_buffer == NULL)
+		return -ENOTSUP;
+
 	return eeprom->ops.write_buffer(hw,  first, length, data);
 }
 
-- 
2.27.0

[PATCH v2] net/ixgbe: fix null dereference on EEPROM write for E610

[Sandeep Penigalapati]

E610 does not support EEPROM writes and leaves eeprom.ops.write_buffer
as NULL. ixgbe_set_eeprom() calls this pointer without checking it,
causing a NULL pointer dereference when a set-eeprom request is issued
on an E610 port.

Check the op for NULL and return -ENOTSUP instead.

Fixes: 316637762a5f ("net/ixgbe/base: enable E610 device")
Cc: stable@dpdk.org

Signed-off-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
---
v2:
 - Moved the NULL check before the argument validation so an
   unsupported request returns -ENOTSUP instead of -EINVAL.

 drivers/net/intel/ixgbe/ixgbe_ethdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
index 78e19f94c0..b7b2b92e3c 100644
--- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
+++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
@@ -7362,6 +7362,9 @@ ixgbe_set_eeprom(struct rte_eth_dev *dev,
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY)
 		return -E_RTE_SECONDARY;
 
+	if (eeprom->ops.write_buffer == NULL)
+		return -ENOTSUP;
+
 	first = in_eeprom->offset >> 1;
 	length = in_eeprom->length >> 1;
 	if ((first > hw->eeprom.word_size) ||
-- 
2.27.0