Commit 1de95db1 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue 

Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2025-09-02 (ice, idpf, i40e, ixgbe, e1000e)

For ice:
Jake adds checks for initialization of Tx timestamp tracking structure
to prevent NULL pointer dereferences.

For idpf:
Josh moves freeing of auxiliary device id to prevent use-after-free issue.

Emil sets, expected, MAC type value when sending virtchnl add/delete MAC
commands.

For i40e:
Jake removes read debugfs access as 'netdev_ops' has the possibility to
overflow.

Zhen Ni adds handling for when MAC list is empty.

For ixgbe:
Alok Tiwari corrects bitmap being used for link speeds.

For e1000e:
Vitaly adds check to ensure overflow does not occur in
e1000_set_eeprom().

* '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
  e1000e: fix heap overflow in e1000_set_eeprom
  ixgbe: fix incorrect map used in eee linkmode
  i40e: Fix potential invalid access when MAC list is empty
  i40e: remove read access to debugfs files
  idpf: set mac type when adding and removing MAC filters
  idpf: fix UAF in RDMA core aux dev deinitialization
  ice: fix NULL access of tx->in_use in ice_ll_ts_intr
  ice: fix NULL access of tx->in_use in ice_ptp_ts_irq
====================

Link: https://patch.msgid.link/20250902232131.2739555-1-anthony.l.nguyen@intel.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 5d6b58c9 90fb7db4

drivers/net/ethernet/intel/e1000e/ethtool.c

+7 −3
Original line number Diff line number Diff line
@@ -549,12 +549,12 @@ static int e1000_set_eeprom(struct net_device *netdev, 
{

	struct e1000_adapter *adapter = netdev_priv(netdev);

	struct e1000_hw *hw = &adapter->hw;

	size_t total_len, max_len;

	u16 *eeprom_buff;

	void *ptr;

	int max_len;

	int ret_val = 0;

	int first_word;

	int last_word;

	int ret_val = 0;

	void *ptr;

	u16 i;



	if (eeprom->len == 0)
@@ -569,6 +569,10 @@ static int e1000_set_eeprom(struct net_device *netdev, 


	max_len = hw->nvm.word_size * 2;



	if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||

	    total_len > max_len)

		return -EFBIG;



	first_word = eeprom->offset >> 1;

	last_word = (eeprom->offset + eeprom->len - 1) >> 1;

	eeprom_buff = kmalloc(max_len, GFP_KERNEL);

drivers/net/ethernet/intel/i40e/i40e_client.c

+2 −2
Original line number Diff line number Diff line
@@ -359,7 +359,7 @@ static void i40e_client_add_instance(struct i40e_pf *pf) 
	if (i40e_client_get_params(vsi, &cdev->lan_info.params))

		goto free_cdev;



	mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,

	mac = list_first_entry_or_null(&cdev->lan_info.netdev->dev_addrs.list,

				       struct netdev_hw_addr, list);

	if (mac)

		ether_addr_copy(cdev->lan_info.lanmac, mac->addr);

drivers/net/ethernet/intel/i40e/i40e_debugfs.c

+19 −104
Original line number Diff line number Diff line
@@ -40,48 +40,6 @@ static struct i40e_vsi *i40e_dbg_find_vsi(struct i40e_pf *pf, int seid) 
 * setup, adding or removing filters, or other things.  Many of

 * these will be useful for some forms of unit testing.

 **************************************************************/

static char i40e_dbg_command_buf[256] = "";



/**

 * i40e_dbg_command_read - read for command datum

 * @filp: the opened file

 * @buffer: where to write the data for the user to read

 * @count: the size of the user's buffer

 * @ppos: file position offset

 **/

static ssize_t i40e_dbg_command_read(struct file *filp, char __user *buffer,

				     size_t count, loff_t *ppos)

{

	struct i40e_pf *pf = filp->private_data;

	struct i40e_vsi *main_vsi;

	int bytes_not_copied;

	int buf_size = 256;

	char *buf;

	int len;



	/* don't allow partial reads */

	if (*ppos != 0)

		return 0;

	if (count < buf_size)

		return -ENOSPC;



	buf = kzalloc(buf_size, GFP_KERNEL);

	if (!buf)

		return -ENOSPC;



	main_vsi = i40e_pf_get_main_vsi(pf);

	len = snprintf(buf, buf_size, "%s: %s\n", main_vsi->netdev->name,

		       i40e_dbg_command_buf);



	bytes_not_copied = copy_to_user(buffer, buf, len);

	kfree(buf);



	if (bytes_not_copied)

		return -EFAULT;



	*ppos = len;

	return len;

}



static char *i40e_filter_state_string[] = {

	"INVALID",
@@ -1621,7 +1579,6 @@ static ssize_t i40e_dbg_command_write(struct file *filp, 
static const struct file_operations i40e_dbg_command_fops = {

	.owner = THIS_MODULE,

	.open =  simple_open,

	.read =  i40e_dbg_command_read,

	.write = i40e_dbg_command_write,

};
@@ -1630,48 +1587,6 @@ static const struct file_operations i40e_dbg_command_fops = { 
 * The netdev_ops entry in debugfs is for giving the driver commands

 * to be executed from the netdev operations.

 **************************************************************/

static char i40e_dbg_netdev_ops_buf[256] = "";



/**

 * i40e_dbg_netdev_ops_read - read for netdev_ops datum

 * @filp: the opened file

 * @buffer: where to write the data for the user to read

 * @count: the size of the user's buffer

 * @ppos: file position offset

 **/

static ssize_t i40e_dbg_netdev_ops_read(struct file *filp, char __user *buffer,

					size_t count, loff_t *ppos)

{

	struct i40e_pf *pf = filp->private_data;

	struct i40e_vsi *main_vsi;

	int bytes_not_copied;

	int buf_size = 256;

	char *buf;

	int len;



	/* don't allow partal reads */

	if (*ppos != 0)

		return 0;

	if (count < buf_size)

		return -ENOSPC;



	buf = kzalloc(buf_size, GFP_KERNEL);

	if (!buf)

		return -ENOSPC;



	main_vsi = i40e_pf_get_main_vsi(pf);

	len = snprintf(buf, buf_size, "%s: %s\n", main_vsi->netdev->name,

		       i40e_dbg_netdev_ops_buf);



	bytes_not_copied = copy_to_user(buffer, buf, len);

	kfree(buf);



	if (bytes_not_copied)

		return -EFAULT;



	*ppos = len;

	return len;

}



/**

 * i40e_dbg_netdev_ops_write - write into netdev_ops datum
@@ -1685,35 +1600,36 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, 
					 size_t count, loff_t *ppos)

{

	struct i40e_pf *pf = filp->private_data;

	char *cmd_buf, *buf_tmp;

	int bytes_not_copied;

	struct i40e_vsi *vsi;

	char *buf_tmp;

	int vsi_seid;

	int i, cnt;



	/* don't allow partial writes */

	if (*ppos != 0)

		return 0;

	if (count >= sizeof(i40e_dbg_netdev_ops_buf))

		return -ENOSPC;



	memset(i40e_dbg_netdev_ops_buf, 0, sizeof(i40e_dbg_netdev_ops_buf));

	bytes_not_copied = copy_from_user(i40e_dbg_netdev_ops_buf,

					  buffer, count);

	if (bytes_not_copied)

	cmd_buf = kzalloc(count + 1, GFP_KERNEL);

	if (!cmd_buf)

		return count;

	bytes_not_copied = copy_from_user(cmd_buf, buffer, count);

	if (bytes_not_copied) {

		kfree(cmd_buf);

		return -EFAULT;

	i40e_dbg_netdev_ops_buf[count] = '\0';

	}

	cmd_buf[count] = '\0';



	buf_tmp = strchr(i40e_dbg_netdev_ops_buf, '\n');

	buf_tmp = strchr(cmd_buf, '\n');

	if (buf_tmp) {

		*buf_tmp = '\0';

		count = buf_tmp - i40e_dbg_netdev_ops_buf + 1;

		count = buf_tmp - cmd_buf + 1;

	}



	if (strncmp(i40e_dbg_netdev_ops_buf, "change_mtu", 10) == 0) {

	if (strncmp(cmd_buf, "change_mtu", 10) == 0) {

		int mtu;



		cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i %i",

		cnt = sscanf(&cmd_buf[11], "%i %i",

			     &vsi_seid, &mtu);

		if (cnt != 2) {

			dev_info(&pf->pdev->dev, "change_mtu <vsi_seid> <mtu>\n");
@@ -1735,8 +1651,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, 
			dev_info(&pf->pdev->dev, "Could not acquire RTNL - please try again\n");

		}



	} else if (strncmp(i40e_dbg_netdev_ops_buf, "set_rx_mode", 11) == 0) {

		cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i", &vsi_seid);

	} else if (strncmp(cmd_buf, "set_rx_mode", 11) == 0) {

		cnt = sscanf(&cmd_buf[11], "%i", &vsi_seid);

		if (cnt != 1) {

			dev_info(&pf->pdev->dev, "set_rx_mode <vsi_seid>\n");

			goto netdev_ops_write_done;
@@ -1756,8 +1672,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, 
			dev_info(&pf->pdev->dev, "Could not acquire RTNL - please try again\n");

		}



	} else if (strncmp(i40e_dbg_netdev_ops_buf, "napi", 4) == 0) {

		cnt = sscanf(&i40e_dbg_netdev_ops_buf[4], "%i", &vsi_seid);

	} else if (strncmp(cmd_buf, "napi", 4) == 0) {

		cnt = sscanf(&cmd_buf[4], "%i", &vsi_seid);

		if (cnt != 1) {

			dev_info(&pf->pdev->dev, "napi <vsi_seid>\n");

			goto netdev_ops_write_done;
@@ -1775,21 +1691,20 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, 
			dev_info(&pf->pdev->dev, "napi called\n");

		}

	} else {

		dev_info(&pf->pdev->dev, "unknown command '%s'\n",

			 i40e_dbg_netdev_ops_buf);

		dev_info(&pf->pdev->dev, "unknown command '%s'\n", cmd_buf);

		dev_info(&pf->pdev->dev, "available commands\n");

		dev_info(&pf->pdev->dev, "  change_mtu <vsi_seid> <mtu>\n");

		dev_info(&pf->pdev->dev, "  set_rx_mode <vsi_seid>\n");

		dev_info(&pf->pdev->dev, "  napi <vsi_seid>\n");

	}

netdev_ops_write_done:

	kfree(cmd_buf);

	return count;

}



static const struct file_operations i40e_dbg_netdev_ops_fops = {

	.owner = THIS_MODULE,

	.open = simple_open,

	.read = i40e_dbg_netdev_ops_read,

	.write = i40e_dbg_netdev_ops_write,

};

drivers/net/ethernet/intel/ice/ice_main.c

+7 −5
Original line number Diff line number Diff line
@@ -3176,12 +3176,14 @@ static irqreturn_t ice_ll_ts_intr(int __always_unused irq, void *data) 
	hw = &pf->hw;

	tx = &pf->ptp.port.tx;

	spin_lock_irqsave(&tx->lock, flags);

	if (tx->init) {

		ice_ptp_complete_tx_single_tstamp(tx);



		idx = find_next_bit_wrap(tx->in_use, tx->len,

					 tx->last_ll_ts_idx_read + 1);

		if (idx != tx->len)

			ice_ptp_req_tx_single_tstamp(tx, idx);

	}

	spin_unlock_irqrestore(&tx->lock, flags);



	val = GLINT_DYN_CTL_INTENA_M | GLINT_DYN_CTL_CLEARPBA_M |

drivers/net/ethernet/intel/ice/ice_ptp.c

+8 −5
Original line number Diff line number Diff line
@@ -2701,16 +2701,19 @@ irqreturn_t ice_ptp_ts_irq(struct ice_pf *pf) 
		 */

		if (hw->dev_caps.ts_dev_info.ts_ll_int_read) {

			struct ice_ptp_tx *tx = &pf->ptp.port.tx;

			u8 idx;

			u8 idx, last;



			if (!ice_pf_state_is_nominal(pf))

				return IRQ_HANDLED;



			spin_lock(&tx->lock);

			if (tx->init) {

				last = tx->last_ll_ts_idx_read + 1;

				idx = find_next_bit_wrap(tx->in_use, tx->len,

						 tx->last_ll_ts_idx_read + 1);

							 last);

				if (idx != tx->len)

					ice_ptp_req_tx_single_tstamp(tx, idx);

			}

			spin_unlock(&tx->lock);



			return IRQ_HANDLED;