[Intel-wired-lan] [PATCH net] igb: fix uninitialized first word in igb_set_eeprom()

[Linkui Xiao]

From: Linkui Xiao <xiaolinkui@xxxxxxxxxx>

igb_set_eeprom() does a read/modify/write of the first EEPROM word when
the requested range does not start on a word boundary. The error from
that read is stored in ret_val but never checked, so the function keeps
going with an eeprom_buff[0] that kmalloc() left uninitialised and
programs it into the NVM. The read failure is not even reported, because
ret_val is overwritten by the result of the write below.

The write is followed by nvm.ops.update(), so the corrupted word is
covered by a fresh checksum and the damage survives a reload.

The read of the last word already bails out on error, do the same for the
first one. Skipping the write also keeps the stale ret_val from being
lost, and igb_set_fw_version() is correctly not called since the NVM was
left untouched.

Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
---
 drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 65014a54a6d1..19ff9eb2c4d2 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -814,6 +814,8 @@ static int igb_set_eeprom(struct net_device *netdev,
 		 */
 		ret_val = hw->nvm.ops.read(hw, first_word, 1,
 					    &eeprom_buff[0]);
+		if (ret_val)
+			goto out;
 		ptr++;
 	}
 	if (((eeprom->offset + eeprom->len) & 1) && (ret_val == 0)) {
-- 
2.25.1