From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1303B2E2665; Mon, 20 Apr 2026 16:00:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776700857; cv=none; b=QwSU3P1A087wPooY3vUngauFf4EpU5H1O4idJEbOMXY2DyE/TcyjHVq1t42dB4pPETlaGcUuTK50mSVlYkw9NW8Cbwd+NEqGvt6Sh9n5n4/Q3NFzrexx7SHZYErEMHwC5gn8ZylawCG0R8WYuqfX9N6V2MJ/ezseYULoN4ZTB38= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776700857; c=relaxed/simple; bh=OLmGB0oD1rmt1gWl/QPAqNJodxIkafcFRt35Kofzd34=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tbn4GwTxnpVTJkq2Y4YAa6UfHFxtLdlHKM37uEdrvmH3Fqe5xaazltJge6LjaRovGpb22qXLqVNog+4Nj1Gk5qrGUpFsOIHPXDx6w97opI2SRzGD0pkZNBN+/9Fhh2cLanDMnlhgSpZWYt+PpXpvAFkK5Lg7BdnznT9ttWEg+Ys= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=X0JnTu9g; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="X0JnTu9g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E1ADC19425; Mon, 20 Apr 2026 16:00:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776700857; bh=OLmGB0oD1rmt1gWl/QPAqNJodxIkafcFRt35Kofzd34=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X0JnTu9gksoMNhNIkGA5pkjygeooNZ0AWt4E3HqEbDMo6jpL1z82XCYfzjelkJJdk WFT81Q+yW3grkhWsy3WwJD+YFxR9CIqZzBN3Ek8IKClP3D6+VCcRw3j6PEd1BB1/Y0 hU5f4mtfKTQo1MumxIKg0TyYodU4aOLWqKaSvEzE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Iskhakov Daniil , Agalakov Daniil , Aleksandr Loktionov , Tony Nguyen , Sasha Levin Subject: [PATCH 6.18 087/198] e1000: check return value of e1000_read_eeprom Date: Mon, 20 Apr 2026 17:41:06 +0200 Message-ID: <20260420153938.739865855@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260420153935.605963767@linuxfoundation.org> References: <20260420153935.605963767@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Agalakov Daniil [ Upstream commit d3baa34a470771399c1495bc04b1e26ac15d598e ] [Why] e1000_set_eeprom() performs a read-modify-write operation when the write range is not word-aligned. This requires reading the first and last words of the range from the EEPROM to preserve the unmodified bytes. However, the code does not check the return value of e1000_read_eeprom(). If the read fails, the operation continues using uninitialized data from eeprom_buff. This results in corrupted data being written back to the EEPROM for the boundary words. Add the missing error checks and abort the operation if reading fails. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen Signed-off-by: Sasha Levin --- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c index 726365c567ef3..75d0bfa7530b4 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c @@ -496,14 +496,19 @@ static int e1000_set_eeprom(struct net_device *netdev, */ ret_val = e1000_read_eeprom(hw, first_word, 1, &eeprom_buff[0]); + if (ret_val) + goto out; + ptr++; } - if (((eeprom->offset + eeprom->len) & 1) && (ret_val == 0)) { + if ((eeprom->offset + eeprom->len) & 1) { /* need read/modify/write of last changed EEPROM word * only the first byte of the word is being modified */ ret_val = e1000_read_eeprom(hw, last_word, 1, &eeprom_buff[last_word - first_word]); + if (ret_val) + goto out; } /* Device's eeprom is always little-endian, word addressable */ @@ -522,6 +527,7 @@ static int e1000_set_eeprom(struct net_device *netdev, if ((ret_val == 0) && (first_word <= EEPROM_CHECKSUM_REG)) e1000_update_eeprom_checksum(hw); +out: kfree(eeprom_buff); return ret_val; } -- 2.53.0