[PATCH 07/10] net/e1000/base: fix NVM loop bounds and pointer access
From: Ciara Loftus <hidden>
Date: 2026-05-20 12:54:01
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Menachem Fogel <redacted>
Improve the NVM checksum routines by ensuring loop bounds are compared
at the correct integer width. Use array indexing instead of explicit
pointer arithmetic.
Fixes: af75078fece3 ("first public release")
Cc: stable@dpdk.org
Signed-off-by: Menachem Fogel <redacted>
Signed-off-by: Dima Ruinskiy <redacted>
Signed-off-by: Ciara Loftus <redacted>
---
drivers/net/intel/e1000/base/e1000_82575.c | 4 ++--
drivers/net/intel/e1000/base/e1000_manage.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/intel/e1000/base/e1000_82575.c b/drivers/net/intel/e1000/base/e1000_82575.c
index c263f42ca1..8ae2b77d5f 100644
--- a/drivers/net/intel/e1000/base/e1000_82575.c
+++ b/drivers/net/intel/e1000/base/e1000_82575.c@@ -2395,7 +2395,7 @@ s32 e1000_validate_nvm_checksum_with_offset(struct e1000_hw *hw, u16 offset) DEBUGFUNC("e1000_validate_nvm_checksum_with_offset"); - for (i = offset; i < ((NVM_CHECKSUM_REG + offset) + 1); i++) { + for (i = offset; i < (u16)((NVM_CHECKSUM_REG + offset) + 1); i++) { ret_val = hw->nvm.ops.read(hw, i, 1, &nvm_data); if (ret_val) { DEBUGOUT("NVM Read Error\n");
@@ -2432,7 +2432,7 @@ s32 e1000_update_nvm_checksum_with_offset(struct e1000_hw *hw, u16 offset) DEBUGFUNC("e1000_update_nvm_checksum_with_offset"); - for (i = offset; i < (NVM_CHECKSUM_REG + offset); i++) { + for (i = offset; i < (u16)(NVM_CHECKSUM_REG + offset); i++) { ret_val = hw->nvm.ops.read(hw, i, 1, &nvm_data); if (ret_val) { DEBUGOUT("NVM Read Error while updating checksum.\n");
diff --git a/drivers/net/intel/e1000/base/e1000_manage.c b/drivers/net/intel/e1000/base/e1000_manage.c
index 4b81028302..71df2890f3 100644
--- a/drivers/net/intel/e1000/base/e1000_manage.c
+++ b/drivers/net/intel/e1000/base/e1000_manage.c@@ -129,7 +129,7 @@ bool e1000_enable_tx_pkt_filtering_generic(struct e1000_hw *hw) len = E1000_MNG_DHCP_COOKIE_LENGTH >> 2; offset = E1000_MNG_DHCP_COOKIE_OFFSET >> 2; for (i = 0; i < len; i++) - *(buffer + i) = E1000_READ_REG_ARRAY_DWORD(hw, E1000_HOST_IF, + buffer[i] = E1000_READ_REG_ARRAY_DWORD(hw, E1000_HOST_IF, offset + i); hdr_csum = hdr->checksum; hdr->checksum = 0;
@@ -173,7 +173,7 @@ s32 e1000_mng_write_cmd_header_generic(struct e1000_hw *hw, /* Write the relevant command block into the ram area. */ for (i = 0; i < length; i++) { E1000_WRITE_REG_ARRAY_DWORD(hw, E1000_HOST_IF, i, - *((u32 *) hdr + i)); + ((u32 *)hdr)[i]); E1000_WRITE_FLUSH(hw); }
--
2.43.0