Commit 90fb7db4 authored by Vitaly Lifshits's avatar Vitaly Lifshits Committed by Tony Nguyen
Browse files

e1000e: fix heap overflow in e1000_set_eeprom 



Fix a possible heap overflow in e1000_set_eeprom function by adding
input validation for the requested length of the change in the EEPROM.
In addition, change the variable type from int to size_t for better
code practices and rearrange declarations to RCT.

Cc: stable@vger.kernel.org
Fixes: bc7f75fa ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
Co-developed-by: default avatarMikael Wessel <post@mikaelkw.online>
Signed-off-by: default avatarMikael Wessel <post@mikaelkw.online>
Signed-off-by: default avatarVitaly Lifshits <vitaly.lifshits@intel.com>
Tested-by: default avatarMor Bar-Gabay <morx.bar.gabay@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
parent b7e5c3e3

drivers/net/ethernet/intel/e1000e/ethtool.c

+7 −3
Original line number Diff line number Diff line
@@ -549,12 +549,12 @@ static int e1000_set_eeprom(struct net_device *netdev, 
{

	struct e1000_adapter *adapter = netdev_priv(netdev);

	struct e1000_hw *hw = &adapter->hw;

	size_t total_len, max_len;

	u16 *eeprom_buff;

	void *ptr;

	int max_len;

	int ret_val = 0;

	int first_word;

	int last_word;

	int ret_val = 0;

	void *ptr;

	u16 i;



	if (eeprom->len == 0)
@@ -569,6 +569,10 @@ static int e1000_set_eeprom(struct net_device *netdev, 


	max_len = hw->nvm.word_size * 2;



	if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||

	    total_len > max_len)

		return -EFBIG;



	first_word = eeprom->offset >> 1;

	last_word = (eeprom->offset + eeprom->len - 1) >> 1;

	eeprom_buff = kmalloc(max_len, GFP_KERNEL);