> -----Original Message-----
> From: Linkui Xiao <[email protected]>
> Sent: Wednesday, September 16, 2026 3:53 PM
> To: Nguyen, Anthony L <[email protected]>; Kitszel,
> Przemyslaw <[email protected]>; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]
> Cc: [email protected]; [email protected]; linux-
> [email protected]; Linkui Xiao <[email protected]>;
> [email protected]
> Subject: [Intel-wired-lan] [PATCH net] igb: fix uninitialized first
> word in igb_set_eeprom()
>
> From: Linkui Xiao <[email protected]>
>
> igb_set_eeprom() does a read/modify/write of the first EEPROM word
> when the requested range does not start on a word boundary. The error
> from that read is stored in ret_val but never checked, so the function
> keeps going with an eeprom_buff[0] that kmalloc() left uninitialised
> and programs it into the NVM. The read failure is not even reported,
> because ret_val is overwritten by the result of the write below.
>
> The write is followed by nvm.ops.update(), so the corrupted word is
> covered by a fresh checksum and the damage survives a reload.
>
> The read of the last word already bails out on error, do the same for
> the first one. Skipping the write also keeps the stale ret_val from
> being lost, and igb_set_fw_version() is correctly not called since the
> NVM was left untouched.
>
> Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver")
> Cc: [email protected]
> Signed-off-by: Linkui Xiao <[email protected]>
> ---
> drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c
> b/drivers/net/ethernet/intel/igb/igb_ethtool.c
> index 65014a54a6d1..19ff9eb2c4d2 100644
> --- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
> +++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
> @@ -814,6 +814,8 @@ static int igb_set_eeprom(struct net_device
> *netdev,
> */
> ret_val = hw->nvm.ops.read(hw, first_word, 1,
> &eeprom_buff[0]);
> + if (ret_val)
> + goto out;
> ptr++;
> }
> if (((eeprom->offset + eeprom->len) & 1) && (ret_val == 0)) {
> --
> 2.25.1
Reviewed-by: Aleksandr Loktionov <[email protected]>
