Re: [PATCH net v2] e1000e: Fix out-of-bounds MMIO access by validating BAR0 size

[Pu Lehui]

On 2026/7/20 22:52, Andrew Lunn wrote:
> > --- a/drivers/net/ethernet/intel/e1000e/regs.h
> > +++ b/drivers/net/ethernet/intel/e1000e/regs.h
> > @@ -242,4 +242,7 @@
> >   /* PHY registers */
> >   #define I82579_DFT_CTRL	PHY_REG(769, 20)
> >   
> > +/* Smallest BAR0 that covers every register the driver accesses */
> > +#define E1000_MMIO_LEN_MIN	0x10000
>
> I commented on the previous version. Is I82579_DFT_CTRL the highest
> register? Can E1000_MMIO_LEN_MIN defines based on that?
>
> 	  Andrew

Hi Andrew,

Thanks for reviewing this! And yeah, I caught your comment on the 
previous version.

I did the math on I82579_DFT_CTRL, and it comes out to 0x6034, so it's 
actually not the highest one. And the registers in regs.h aren't really 
sorted by address anyway.

The highest static address is E1000_SYSSTMPH(0x0B64C)
The highest dynamic address is E1000_TXDCTL(_n), as it define bellow:

#define E1000_TXDCTL(_n) ((_n) < 4 ? (0x03828 + ((_n) * 0x100)) : \
                         (0x0E028 + ((_n) * 0x40)))

But since the maximum _n we use in the e1000e driver is just 1, that 
address maxes out at only 0x3928.

So, since E1000_SYSSTMPH is the highest register offset the driver 
actually accesses, how about we just define E1000_MMIO_LEN_MIN based on 
that? Something like:

/* Smallest BAR0 that covers every register the driver accesses */
#define E1000_MMIO_LEN_MIN	E1000_SYSSTMPH

Thanks,
Lehui