[PATCH iwl-next v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

[PATCH iwl-next v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

[Aleksandr Loktionov]

ixgbe_host_interface_command() treats its buffer as a u32 array. The 
local buffer we pass in was a union of byte-sized fields, which gives 
it 1-byte alignment on the stack. On strict-align architectures this 
can cause unaligned 32-bit accesses.

Add a u32 member to union ixgbe_hic_hdr2 so the object is 4-byte 
aligned, and pass the u32 member when calling
ixgbe_host_interface_command().

No functional change on x86; prevents unaligned accesses on 
architectures that enforce natural alignment.
 
Fixes: 49425dfc7451 ("ixgbe: Add support for x550em_a 10G MAC type")
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
---
v2 -> v3 commit message line wraps
v1 -> v2 change title and concentrate on alignement issue
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 1 +
 drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 61f2ef6..eb5bf3b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -2798,6 +2798,7 @@ struct ixgbe_hic_hdr2_rsp {
 };
 
 union ixgbe_hic_hdr2 {
+	u32 buf[1];
 	struct ixgbe_hic_hdr2_req req;
 	struct ixgbe_hic_hdr2_rsp rsp;
 };
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
index 76d2fa3..4a0ccbf 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
@@ -1228,7 +1228,7 @@ static int ixgbe_update_flash_X550(struct ixgbe_hw *hw)
 	buffer.req.buf_lenl = FW_SHADOW_RAM_DUMP_LEN;
 	buffer.req.checksum = FW_DEFAULT_CHECKSUM;
 
-	status = ixgbe_host_interface_command(hw, &buffer, sizeof(buffer),
+	status = ixgbe_host_interface_command(hw, buffer.buf, sizeof(buffer),
 					      IXGBE_HI_COMMAND_TIMEOUT, false);
 	return status;
 }
-- 
2.52.0

Re: [iwl-next,v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

[Simon Horman]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

This commit adds a u32 member to union ixgbe_hic_hdr2 to ensure 4-byte
alignment on the stack, preventing unaligned 32-bit accesses when
ixgbe_host_interface_command() treats the buffer as a u32 array.

> ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
>
> ixgbe_host_interface_command() treats its buffer as a u32 array. The
> local buffer we pass in was a union of byte-sized fields, which gives
> it 1-byte alignment on the stack. On strict-align architectures this
> can cause unaligned 32-bit accesses.
>
> Add a u32 member to union ixgbe_hic_hdr2 so the object is 4-byte
> aligned, and pass the u32 member when calling
> ixgbe_host_interface_command().
>
> No functional change on x86; prevents unaligned accesses on
> architectures that enforce natural alignment.
>
> Fixes: 49425dfc7451 ("ixgbe: Add support for x550em_a 10G MAC type")

Does this Fixes tag point to the correct commit? The alignment issue
appears to have been introduced by commit 6a14ee0cfb19 ("ixgbe: Add X550
support function pointers") from 2014-12-05, which introduced both the
union ixgbe_hic_hdr2 without a u32 member for proper alignment and the
ixgbe_update_flash_X550() function that passes this buffer to
ixgbe_host_interface_command().

Commit 49425dfc7451 from 2016-04-01 only added support for the x550em_a
MAC type and did not introduce the alignment bug.

Should the Fixes tag be:
Fixes: 6a14ee0cfb19 ("ixgbe: Add X550 support function pointers")

> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> index 61f2ef67defd..eb5bf3b6bbb5 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> @@ -2798,6 +2798,7 @@ struct ixgbe_hic_hdr2_rsp {
>  };
>
>  union ixgbe_hic_hdr2 {
> +	u32 buf[1];
>  	struct ixgbe_hic_hdr2_req req;
>  	struct ixgbe_hic_hdr2_rsp rsp;
>  };

[ ... ]

RE: [iwl-next,v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Simon Horman <horms@kernel.org>
> Sent: Friday, February 13, 2026 4:14 PM
> To: Loktionov, Aleksandr <aleksandr.loktionov@intel.com>
> Cc: Simon Horman <horms@kernel.org>; intel-wired-lan@lists.osuosl.org;
> Jagielski, Jedrzej <jedrzej.jagielski@intel.com>; Nguyen, Anthony L
> <anthony.l.nguyen@intel.com>; pmenzel@molgen.mpg.de;
> netdev@vger.kernel.org
> Subject: Re: [iwl-next,v3] ixgbe: fix unaligned u32 access in
> ixgbe_update_flash_X550()
> 
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> 
> For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-
> local.html
> ---
> ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
> 
> This commit adds a u32 member to union ixgbe_hic_hdr2 to ensure 4-byte
> alignment on the stack, preventing unaligned 32-bit accesses when
> ixgbe_host_interface_command() treats the buffer as a u32 array.
> 
> > ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
> >
> > ixgbe_host_interface_command() treats its buffer as a u32 array. The
> > local buffer we pass in was a union of byte-sized fields, which
> gives
> > it 1-byte alignment on the stack. On strict-align architectures this
> > can cause unaligned 32-bit accesses.
> >
> > Add a u32 member to union ixgbe_hic_hdr2 so the object is 4-byte
> > aligned, and pass the u32 member when calling
> > ixgbe_host_interface_command().
> >
> > No functional change on x86; prevents unaligned accesses on
> > architectures that enforce natural alignment.
> >
> > Fixes: 49425dfc7451 ("ixgbe: Add support for x550em_a 10G MAC type")
> 
> Does this Fixes tag point to the correct commit? The alignment issue
> appears to have been introduced by commit 6a14ee0cfb19 ("ixgbe: Add
> X550 support function pointers") from 2014-12-05, which introduced
> both the union ixgbe_hic_hdr2 without a u32 member for proper
> alignment and the
> ixgbe_update_flash_X550() function that passes this buffer to
> ixgbe_host_interface_command().

Commit is correct, please configure your AI to look all the history of the patch, where I explained that it was a 0 day issue.

With the best regards
Alex

> 
> Commit 49425dfc7451 from 2016-04-01 only added support for the
> x550em_a MAC type and did not introduce the alignment bug.
> 
> Should the Fixes tag be:
> Fixes: 6a14ee0cfb19 ("ixgbe: Add X550 support function pointers")
> 
> > diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> > b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> > index 61f2ef67defd..eb5bf3b6bbb5 100644
> > --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> > +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
> > @@ -2798,6 +2798,7 @@ struct ixgbe_hic_hdr2_rsp {  };
> >
> >  union ixgbe_hic_hdr2 {
> > +	u32 buf[1];
> >  	struct ixgbe_hic_hdr2_req req;
> >  	struct ixgbe_hic_hdr2_rsp rsp;
> >  };
> 
> [ ... ]

Re: [iwl-next,v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

[Simon Horman]

On Fri, Feb 13, 2026 at 04:02:53PM +0000, Loktionov, Aleksandr wrote:
> 
> 
> > -----Original Message-----
> > From: Simon Horman <horms@kernel.org>
> > Sent: Friday, February 13, 2026 4:14 PM
> > To: Loktionov, Aleksandr <aleksandr.loktionov@intel.com>
> > Cc: Simon Horman <horms@kernel.org>; intel-wired-lan@lists.osuosl.org;
> > Jagielski, Jedrzej <jedrzej.jagielski@intel.com>; Nguyen, Anthony L
> > <anthony.l.nguyen@intel.com>; pmenzel@molgen.mpg.de;
> > netdev@vger.kernel.org
> > Subject: Re: [iwl-next,v3] ixgbe: fix unaligned u32 access in
> > ixgbe_update_flash_X550()
> > 
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
> > 
> > For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-
> > local.html
> > ---
> > ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
> > 
> > This commit adds a u32 member to union ixgbe_hic_hdr2 to ensure 4-byte
> > alignment on the stack, preventing unaligned 32-bit accesses when
> > ixgbe_host_interface_command() treats the buffer as a u32 array.
> > 
> > > ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
> > >
> > > ixgbe_host_interface_command() treats its buffer as a u32 array. The
> > > local buffer we pass in was a union of byte-sized fields, which
> > gives
> > > it 1-byte alignment on the stack. On strict-align architectures this
> > > can cause unaligned 32-bit accesses.
> > >
> > > Add a u32 member to union ixgbe_hic_hdr2 so the object is 4-byte
> > > aligned, and pass the u32 member when calling
> > > ixgbe_host_interface_command().
> > >
> > > No functional change on x86; prevents unaligned accesses on
> > > architectures that enforce natural alignment.
> > >
> > > Fixes: 49425dfc7451 ("ixgbe: Add support for x550em_a 10G MAC type")
> > 
> > Does this Fixes tag point to the correct commit? The alignment issue
> > appears to have been introduced by commit 6a14ee0cfb19 ("ixgbe: Add
> > X550 support function pointers") from 2014-12-05, which introduced
> > both the union ixgbe_hic_hdr2 without a u32 member for proper
> > alignment and the
> > ixgbe_update_flash_X550() function that passes this buffer to
> > ixgbe_host_interface_command().
> 
> Commit is correct, please configure your AI to look all the history of the patch, where I explained that it was a 0 day issue.

Sorry about that. I did look over this myself, but I guess I must
a have forgotten to look over the patch history at the time.

...

RE: [Intel-wired-lan] [PATCH iwl-next v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()

[Rinitha, SX]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of Aleksandr Loktionov
> Sent: 13 February 2026 08:40
> To: intel-wired-lan@lists.osuosl.org; Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Loktionov, Aleksandr <aleksandr.loktionov@intel.com>
> Cc: netdev@vger.kernel.org; Jagielski, Jedrzej <jedrzej.jagielski@intel.com>; Paul Menzel <pmenzel@molgen.mpg.de>
> Subject: [Intel-wired-lan] [PATCH iwl-next v3] ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
>
> ixgbe_host_interface_command() treats its buffer as a u32 array. The local buffer we pass in was a union of byte-sized fields, which gives it 1-byte alignment on the stack. On strict-align architectures this can cause unaligned 32-bit accesses.
>
> Add a u32 member to union ixgbe_hic_hdr2 so the object is 4-byte aligned, and pass the u32 member when calling ixgbe_host_interface_command().
>
> No functional change on x86; prevents unaligned accesses on architectures that enforce natural alignment.
>
> Fixes: 49425dfc7451 ("ixgbe: Add support for x550em_a 10G MAC type")
> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> Reviewed-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
> ---
> v2 -> v3 commit message line wraps
> v1 -> v2 change title and concentrate on alignement issue
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 1 +  drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 2 +-
> 2 files changed, 2 insertions(+), 1 deletion(-)
>

Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)