e1000e: limit endianness conversion to boundary words

[Why]
In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of
words. However, only the boundary words (the first and the last) are
populated from the EEPROM if the write request is not word-aligned.
The words in the middle of the buffer remain uninitialized because they
are intended to be completely overwritten by the new data via memcpy().

The previous implementation had a loop that performed le16_to_cpus()
on the entire buffer. This resulted in endianness conversion being
performed on uninitialized memory for all interior words.

Fix this by converting the endianness only for the boundary words
immediately after they are successfully read from the EEPROM.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Co-developed-by: Iskhakov Daniil <dish@amicon.ru>
Signed-off-by: Iskhakov Daniil <dish@amicon.ru>
Signed-off-by: Agalakov Daniil <ade@amicon.ru>
Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Link: https://patch.msgid.link/20260609213559.178657-14-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index dbed30943ef4d55b02c79e7bfb50918a6e6a0258..a8b35ae4114175dc50afe53e6d385a79424a022c 100644 (file)
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -583,20 +583,25 @@ static int e1000_set_eeprom(struct net_device *netdev,
                /* need read/modify/write of first changed EEPROM word */
                /* only the second byte of the word is being modified */
                ret_val = e1000_read_nvm(hw, first_word, 1, &eeprom_buff[0]);
+               if (ret_val)
+                       goto out;
+
+               /* Device's eeprom is always little-endian, word addressable */
+               le16_to_cpus(&eeprom_buff[0]);
+
                ptr++;
        }
-       if (((eeprom->offset + eeprom->len) & 1) && (!ret_val))
+       if ((eeprom->offset + eeprom->len) & 1) {
                /* need read/modify/write of last changed EEPROM word */
                /* only the first byte of the word is being modified */
                ret_val = e1000_read_nvm(hw, last_word, 1,
                                         &eeprom_buff[last_word - first_word]);
+               if (ret_val)
+                       goto out;
 
-       if (ret_val)
-               goto out;
-
-       /* Device's eeprom is always little-endian, word addressable */
-       for (i = 0; i < last_word - first_word + 1; i++)
-               le16_to_cpus(&eeprom_buff[i]);
+               /* Device's eeprom is always little-endian, word addressable */
+               le16_to_cpus(&eeprom_buff[last_word - first_word]);
+       }
 
        memcpy(ptr, bytes, eeprom->len);