From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34B65522F17; Wed, 30 Sep 2026 17:56:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790791004; cv=none; b=qzZ0jHAJMl55cffSolDXGvrdhm8MAWaKxYuANl+Ou8L0xd0NuFSEWEiuyP04h0CY3rZhtlWxGWeZd9SIm/zR+10eBlp8phdNlPRZypcZNvMKnQnkqVZQJo6FcsBBdRinpAY6YHUOSb8UMswyvGKdIvlEa37wmFUUJkQYripGvzM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790791004; c=relaxed/simple; bh=vaZ3vUGGvf1i2/eNfLzCPOcqMCDvnxG9hDrYOphgsAo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jEoa5wLv13POe+gzRWVLJ5jnxMg4D7UeDML9HVMJUiaECNuEsEvIoP27f9DjBexmtsvGEtf+GRfM2nDb+6OpEECadOJ41h2KE6oiaO/a4nJ/I9TrWZv9nvOWN8dkZlNpIERLBWnojjqSWyISHkqKh4OZcrvQJA/ZrBvnj7N1NSQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EBBO7GIQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EBBO7GIQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 966E61F00898; Wed, 30 Sep 2026 17:56:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790791003; bh=+tTFjSFr8X/LL0yp2LMJuslQBf1C/diUJoTERDmTHuc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EBBO7GIQdKCsfBttuIGekHLAGP9W/9cDxbEDdAM1Mgov6TssRdAlWUdO+BMTEu4m7 FWYJhhfRK2XNu7l0W5L+cBw9aPVmApgnp8psXXPpSCDhzisW4c2pCX9XKkbCBxqgGz HXJ5xB+7W4UEImD4mg1j0qY6F/cSlR+cUMX5OvPI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Iskhakov Daniil , Agalakov Daniil , Avigail Dahan , Tony Nguyen , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 150/752] e1000e: limit endianness conversion to boundary words Date: Wed, 30 Sep 2026 17:20:20 +0200 Message-ID: <20260930152401.431473110@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260930152358.131179731@linuxfoundation.org> References: <20260930152358.131179731@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Agalakov Daniil [ Upstream commit a5ecafcfb27baf2dba766c4fd99dbb947f4e85d8 ] [Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260609213559.178657-14-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/intel/e1000e/ethtool.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c index 9d1fcae545fb8..4b973835a8dba 100644 --- a/drivers/net/ethernet/intel/e1000e/ethtool.c +++ b/drivers/net/ethernet/intel/e1000e/ethtool.c @@ -597,20 +597,25 @@ static int e1000_set_eeprom(struct net_device *netdev, /* need read/modify/write of first changed EEPROM word */ /* only the second byte of the word is being modified */ ret_val = e1000_read_nvm(hw, first_word, 1, &eeprom_buff[0]); + if (ret_val) + goto out; + + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[0]); + ptr++; } - if (((eeprom->offset + eeprom->len) & 1) && (!ret_val)) + if ((eeprom->offset + eeprom->len) & 1) { /* need read/modify/write of last changed EEPROM word */ /* only the first byte of the word is being modified */ ret_val = e1000_read_nvm(hw, last_word, 1, &eeprom_buff[last_word - first_word]); + if (ret_val) + goto out; - if (ret_val) - goto out; - - /* Device's eeprom is always little-endian, word addressable */ - for (i = 0; i < last_word - first_word + 1; i++) - le16_to_cpus(&eeprom_buff[i]); + /* Device's eeprom is always little-endian, word addressable */ + le16_to_cpus(&eeprom_buff[last_word - first_word]); + } memcpy(ptr, bytes, eeprom->len); -- 2.53.0