> -----Original Message-----
> From: Intel-wired-lan <[email protected]> On Behalf
> Of Vitaly Lifshits
> Sent: Thursday, August 7, 2025 6:05 AM
> To: [email protected]
> Cc: Lifshits, Vitaly <[email protected]>; Mikael Wessel
> <[email protected]>
> Subject: [Intel-wired-lan] [PATCH iwl-net v2 1/1] e1000e: fix heap
> overflow in e1000_set_eeprom
>
> Fix a possible heap overflow in e1000_set_eeprom function by adding
> input validation for the requested length of the change in the EEPROM.
>
> Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver
> (currently for ICH9 devices only)")
> Co-developed-by: Mikael Wessel <[email protected]>
> Signed-off-by: Mikael Wessel <[email protected]>
> Signed-off-by: Vitaly Lifshits <[email protected]>
Reviewed-by: Aleksandr Loktionov <[email protected]>
> ---
> v2: Use check_add_overflow for boundary checking
> ---
> drivers/net/ethernet/intel/e1000e/ethtool.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c
> b/drivers/net/ethernet/intel/e1000e/ethtool.c
> index 9364bc2b4eb1..2bfbc7fd9559 100644
> --- a/drivers/net/ethernet/intel/e1000e/ethtool.c
> +++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
> @@ -550,6 +550,7 @@ static int e1000_set_eeprom(struct net_device
> *netdev,
> struct e1000_adapter *adapter = netdev_priv(netdev);
> struct e1000_hw *hw = &adapter->hw;
> u16 *eeprom_buff;
> + u32 total_len;
> void *ptr;
> int max_len;
> int first_word;
> @@ -569,6 +570,10 @@ static int e1000_set_eeprom(struct net_device
> *netdev,
>
> max_len = hw->nvm.word_size * 2;
>
> + if (check_add_overflow(eeprom->offset, eeprom->len, &total_len)
> ||
> + total_len > max_len)
> + return -EINVAL;
> +
> first_word = eeprom->offset >> 1;
> last_word = (eeprom->offset + eeprom->len - 1) >> 1;
> eeprom_buff = kmalloc(max_len, GFP_KERNEL);
> --
> 2.34.1
