e1000: limit endianness conversion to boundary words
[Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Co-developed-by: Iskhakov Daniil <dish@amicon.ru> Signed-off-by: Iskhakov Daniil <dish@amicon.ru> Signed-off-by: Agalakov Daniil <ade@amicon.ru> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-13-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
1 parent
4d9508d97b
commit
4cc8566ae0
1 file changed
+6
-4
@@ -499,6 +499,9 @@ static int e1000_set_eeprom(struct net_device *netdev,
|
||||
if (ret_val)
|
||||
goto out;
|
||||
|
||||
/* Device's eeprom is always little-endian, word addressable */
|
||||
le16_to_cpus(&eeprom_buff[0]);
|
||||
|
||||
ptr++;
|
||||
}
|
||||
if ((eeprom->offset + eeprom->len) & 1) {
|
||||
@@ -509,11 +512,10 @@ static int e1000_set_eeprom(struct net_device *netdev,
|
||||
&eeprom_buff[last_word - first_word]);
|
||||
if (ret_val)
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Device's eeprom is always little-endian, word addressable */
|
||||
for (i = 0; i < last_word - first_word + 1; i++)
|
||||
le16_to_cpus(&eeprom_buff[i]);
|
||||
/* Device's eeprom is always little-endian, word addressable */
|
||||
le16_to_cpus(&eeprom_buff[last_word - first_word]);
|
||||
}
|
||||
|
||||
memcpy(ptr, bytes, eeprom->len);
|
||||
|
||||
|
||||
Reference in new issue
Block a user