From: Linkui Xiao <[email protected]>
igb_set_eeprom() does a read/modify/write of the first EEPROM word when
the requested range does not start on a word boundary. The error from
that read is stored in ret_val but never checked, so the function keeps
going with an eeprom_buff[0] that kmalloc() left uninitialised and
programs it into the NVM. The read failure is not even reported, because
ret_val is overwritten by the result of the write below.
The write is followed by nvm.ops.update(), so the corrupted word is
covered by a fresh checksum and the damage survives a reload.
The read of the last word already bails out on error, do the same for the
first one. Skipping the write also keeps the stale ret_val from being
lost, and igb_set_fw_version() is correctly not called since the NVM was
left untouched.
Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver")
Cc: [email protected]
Signed-off-by: Linkui Xiao <[email protected]>
---
drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c
b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 65014a54a6d1..19ff9eb2c4d2 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -814,6 +814,8 @@ static int igb_set_eeprom(struct net_device *netdev,
*/
ret_val = hw->nvm.ops.read(hw, first_word, 1,
&eeprom_buff[0]);
+ if (ret_val)
+ goto out;
ptr++;
}
if (((eeprom->offset + eeprom->len) & 1) && (ret_val == 0)) {
--
2.25.1
