Re: [PATCH net v2] e1000e: Fix out-of-bounds MMIO access by validating BAR0 size

[Andrew Lunn]

On Tue, Jul 21, 2026 at 10:06:10AM +0800, Pu Lehui wrote:
> 
> On 2026/7/20 22:52, Andrew Lunn wrote:
> > > --- a/drivers/net/ethernet/intel/e1000e/regs.h
> > > +++ b/drivers/net/ethernet/intel/e1000e/regs.h
> > > @@ -242,4 +242,7 @@
> > >   /* PHY registers */
> > >   #define I82579_DFT_CTRL	PHY_REG(769, 20)
> > > +/* Smallest BAR0 that covers every register the driver accesses */
> > > +#define E1000_MMIO_LEN_MIN	0x10000
> > 
> > I commented on the previous version. Is I82579_DFT_CTRL the highest
> > register? Can E1000_MMIO_LEN_MIN defines based on that?
> > 
> > 	  Andrew
> 
> Hi Andrew,
> 
> Thanks for reviewing this! And yeah, I caught your comment on the previous
> version.
> 
> I did the math on I82579_DFT_CTRL, and it comes out to 0x6034, so it's
> actually not the highest one. And the registers in regs.h aren't really
> sorted by address anyway.
> 
> The highest static address is E1000_SYSSTMPH(0x0B64C)
> The highest dynamic address is E1000_TXDCTL(_n), as it define bellow:
> 
> #define E1000_TXDCTL(_n) ((_n) < 4 ? (0x03828 + ((_n) * 0x100)) : \
>                          (0x0E028 + ((_n) * 0x40)))
> 
> But since the maximum _n we use in the e1000e driver is just 1, that address
> maxes out at only 0x3928.
> 
> So, since E1000_SYSSTMPH is the highest register offset the driver actually
> accesses, how about we just define E1000_MMIO_LEN_MIN based on that?
> Something like:
> 
> /* Smallest BAR0 that covers every register the driver accesses */
> #define E1000_MMIO_LEN_MIN	E1000_SYSSTMPH

What is the size of this register? U32? Maybe you actually need:

#define E1000_MMIO_LEN_MIN	E1000_SYSSTMPH + sizeof(u32)

	Andrew