]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net: txgbe: fix heap overflow when reading module EEPROM
authorChenguang Zhao <zhaochenguang@kylinos.cn>
Mon, 13 Jul 2026 08:51:11 +0000 (16:51 +0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 21 Jul 2026 19:13:24 +0000 (12:13 -0700)
commit6a905a71fd43ce8b45f05044b11491337f232c9d
tree8561795aa5bbebd5f6a6f77cc7b5c171b764f648
parent043c1f6d84f6cd5d23ddd508ce5209cf0a3a3f41
net: txgbe: fix heap overflow when reading module EEPROM

txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes
into the caller buffer, which ethtool allocates with exactly 'length'
bytes. A non-4-aligned length therefore causes an out-of-bounds write.
Copy only the remaining bytes on the final dword instead.

Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Fixes: 9b97b6b5635b ("net: txgbe: support getting module EEPROM by page")
Link: https://patch.msgid.link/20260713085111.1481884-1-chenguang.zhao@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c