For the future please tag your intel ethernet submissions as
iwl-net (fixes) or iwl-next (refactors/features).
(Applies to v2 of this series).
On 7/6/26 11:25, Pengpeng Hou wrote:
ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
EEPROM.
Stop parsing malformed TLVs whose header or declared value length would
exceed the PFA boundary.
this is a "beware of malicious NVM" type of change...
Signed-off-by: Pengpeng Hou <[email protected]>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
index 4d8ae5b56145..03e88bdf5a43 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
@@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw,
u16 *module_tlv,
while (next_tlv < pfa_end_ptr) {
u16 tlv_sub_module_type, tlv_len;
+ if (pfa_end_ptr - next_tlv < 2)
instead of wrap-around arithmetics it would be better to use
size_add/size_sub
+ break;
+
/* Read TLV type */
err = ixgbe_read_ee_aci_e610(hw, next_tlv,
&tlv_sub_module_type);
@@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw,
u16 *module_tlv,
/* Check next TLV, i.e. current TLV pointer + length + 2 words
* (for current TLV's type and length).
*/
+ if (tlv_len > pfa_end_ptr - next_tlv - 2)
+ break;
+
next_tlv = next_tlv + tlv_len + 2;
}
/* Module does not exist */
