Re: [PATCH net] e100: fix shift-out-of-bounds in e100_eeprom_load()

From: Andrew Lunn

Date: Mon Aug 10 2026 - 13:57:30 EST


On Mon, Aug 10, 2026 at 06:38:15AM +0000, Malathi wrote:
> e100_eeprom_load() and e100_eeprom_save() start with an address length
> of 8 and call e100_eeprom_read() to auto-detect the real EEPROM address
> length. e100_eeprom_read() adjusts the length with
>
> *addr_len -= (i - 16);
>
> based on when the EEPROM drives a dummy zero onto EEDO. A malfunctioning
> or emulated device that drives EEDO low too early makes (i - 16) exceed
> the current length, underflowing the u16 addr_len to a large value such
> as 65529.

So this is a theoretical issue which never happens, and bothers
nobody. This does not meet the requirements for stable. Please target
net-next and drop the Fixes tag.

Andrew