From: Jakub Kicinski <kuba@kernel.org>
To: davem@davemloft.net
Cc: netdev@vger.kernel.org, edumazet@google.com, pabeni@redhat.com,
andrew+netdev@lunn.ch, horms@kernel.org, o.rempel@pengutronix.de,
kory.maincent@bootlin.com, maxime.chevallier@bootlin.com,
haiyangz@microsoft.com, Jakub Kicinski <kuba@kernel.org>,
andrew@lunn.ch, vladyslavt@nvidia.com
Subject: [PATCH net 10/10] ethtool: eeprom: add more safeties to EEPROM Netlink fallback
Date: Tue, 26 May 2026 08:35:33 -0700 [thread overview]
Message-ID: <20260526153533.2779187-11-kuba@kernel.org> (raw)
In-Reply-To: <20260526153533.2779187-1-kuba@kernel.org>
The Netlink fallback path for reading module EEPROM
(fallback_set_params()) validates that offset < eeprom_len,
but does not check that offset + length stays within eeprom_len.
The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has
always enforced both bounds:
if (eeprom.offset + eeprom.len > total_len)
return -EINVAL;
This could lead to surprises in both drivers and device FW.
Add the missing offset + length validation to fallback_set_params(),
mirroring the ioctl.
Similarly - ethtool core in general, and ethtool_get_any_eeprom()
in particular tries to zero-init all buffers passed to the drivers
to avoid any extra work of zeroing things out. eeprom_fallback()
uses a plain kmalloc(), change it to zalloc.
Fixes: 96d971e307cc ("ethtool: Add fallback to get_module_eeprom from netlink command")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: andrew@lunn.ch
CC: maxime.chevallier@bootlin.com
CC: vladyslavt@nvidia.com
---
net/ethtool/eeprom.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ethtool/eeprom.c b/net/ethtool/eeprom.c
index 836316df3092..0b8cfeddb014 100644
--- a/net/ethtool/eeprom.c
+++ b/net/ethtool/eeprom.c
@@ -44,6 +44,9 @@ static int fallback_set_params(struct eeprom_req_info *request,
if (offset >= modinfo->eeprom_len)
return -EINVAL;
+ if (length > modinfo->eeprom_len - offset)
+ return -EINVAL;
+
eeprom->cmd = ETHTOOL_GMODULEEEPROM;
eeprom->len = length;
eeprom->offset = offset;
@@ -69,7 +72,7 @@ static int eeprom_fallback(struct eeprom_req_info *request,
if (err < 0)
return err;
- data = kmalloc(eeprom.len, GFP_KERNEL);
+ data = kzalloc(eeprom.len, GFP_KERNEL);
if (!data)
return -ENOMEM;
err = ethtool_get_module_eeprom_call(dev, &eeprom, data);
--
2.54.0
next prev parent reply other threads:[~2026-05-26 15:35 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-26 15:35 [PATCH net 00/10] ethtool: more bug fixes Jakub Kicinski
2026-05-26 15:35 ` [PATCH net 01/10] ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Jakub Kicinski
2026-05-26 17:41 ` Maxime Chevallier
2026-05-26 15:35 ` [PATCH net 02/10] ethtool: tsconfig: fix reply error handling Jakub Kicinski
2026-05-26 16:04 ` Vadim Fedorenko
2026-05-27 14:32 ` Kory Maincent
2026-05-26 15:35 ` [PATCH net 03/10] ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski
2026-05-26 16:41 ` Maxime Chevallier
2026-05-26 15:35 ` [PATCH net 04/10] ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski
2026-05-26 16:51 ` Maxime Chevallier
2026-05-26 15:35 ` [PATCH net 05/10] ethtool: tsconfig: " Jakub Kicinski
2026-05-26 16:06 ` Vadim Fedorenko
2026-05-27 14:34 ` Kory Maincent
2026-05-26 15:35 ` [PATCH net 06/10] ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski
2026-05-26 17:23 ` Maxime Chevallier
2026-05-26 22:51 ` Jakub Kicinski
2026-05-26 15:35 ` [PATCH net 07/10] ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski
2026-05-26 17:46 ` Maxime Chevallier
2026-05-27 14:35 ` Kory Maincent
2026-05-26 15:35 ` [PATCH net 08/10] ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski
2026-05-26 17:15 ` Maxime Chevallier
2026-05-26 15:35 ` [PATCH net 09/10] ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski
2026-05-26 17:13 ` Maxime Chevallier
2026-05-26 15:35 ` Jakub Kicinski [this message]
2026-05-26 17:30 ` [PATCH net 10/10] ethtool: eeprom: add more safeties to EEPROM Netlink fallback Maxime Chevallier
2026-05-28 1:00 ` [PATCH net 00/10] ethtool: more bug fixes patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260526153533.2779187-11-kuba@kernel.org \
--to=kuba@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=andrew@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=haiyangz@microsoft.com \
--cc=horms@kernel.org \
--cc=kory.maincent@bootlin.com \
--cc=maxime.chevallier@bootlin.com \
--cc=netdev@vger.kernel.org \
--cc=o.rempel@pengutronix.de \
--cc=pabeni@redhat.com \
--cc=vladyslavt@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.