RE: [Intel-wired-lan] [PATCH net] igb: fix uninitialized first word in igb_set_eeprom()

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Linkui Xiao <xiaolinkui@xxxxxxx>
> Sent: Wednesday, September 16, 2026 3:53 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>; andrew+netdev@xxxxxxx;
> davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx; kuba@xxxxxxxxxx;
> pabeni@xxxxxxxxxx
> Cc: intel-wired-lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; Linkui Xiao <xiaolinkui@xxxxxxxxxx>;
> stable@xxxxxxxxxxxxxxx
> Subject: [Intel-wired-lan] [PATCH net] igb: fix uninitialized first
> word in igb_set_eeprom()
> 
> From: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
> 
> igb_set_eeprom() does a read/modify/write of the first EEPROM word
> when the requested range does not start on a word boundary. The error
> from that read is stored in ret_val but never checked, so the function
> keeps going with an eeprom_buff[0] that kmalloc() left uninitialised
> and programs it into the NVM. The read failure is not even reported,
> because ret_val is overwritten by the result of the write below.
> 
> The write is followed by nvm.ops.update(), so the corrupted word is
> covered by a fresh checksum and the damage survives a reload.
> 
> The read of the last word already bails out on error, do the same for
> the first one. Skipping the write also keeps the stale ret_val from
> being lost, and igb_set_fw_version() is correctly not called since the
> NVM was left untouched.
> 
> Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
> ---
>  drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c
> b/drivers/net/ethernet/intel/igb/igb_ethtool.c
> index 65014a54a6d1..19ff9eb2c4d2 100644
> --- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
> +++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
> @@ -814,6 +814,8 @@ static int igb_set_eeprom(struct net_device
> *netdev,
>  		 */
>  		ret_val = hw->nvm.ops.read(hw, first_word, 1,
>  					    &eeprom_buff[0]);
> +		if (ret_val)
> +			goto out;
>  		ptr++;
>  	}
>  	if (((eeprom->offset + eeprom->len) & 1) && (ret_val == 0)) {
> --
> 2.25.1

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>