Re: [PATCH net v2] e1000e: Fix out-of-bounds MMIO access by validating BAR0 size

[Pu Lehui]

On 2026/7/21 21:02, Andrew Lunn wrote:
> On Tue, Jul 21, 2026 at 10:06:10AM +0800, Pu Lehui wrote:
> > On 2026/7/20 22:52, Andrew Lunn wrote:
> > > > --- a/drivers/net/ethernet/intel/e1000e/regs.h
> > > > +++ b/drivers/net/ethernet/intel/e1000e/regs.h
> > > > @@ -242,4 +242,7 @@
> > > >    /* PHY registers */
> > > >    #define I82579_DFT_CTRL	PHY_REG(769, 20)
> > > > +/* Smallest BAR0 that covers every register the driver accesses */
> > > > +#define E1000_MMIO_LEN_MIN	0x10000
> > >
> > > I commented on the previous version. Is I82579_DFT_CTRL the highest
> > > register? Can E1000_MMIO_LEN_MIN defines based on that?
> > >
> > > 	  Andrew
> >
> > Hi Andrew,
> >
> > Thanks for reviewing this! And yeah, I caught your comment on the previous
> > version.
> >
> > I did the math on I82579_DFT_CTRL, and it comes out to 0x6034, so it's
> > actually not the highest one. And the registers in regs.h aren't really
> > sorted by address anyway.
> >
> > The highest static address is E1000_SYSSTMPH(0x0B64C)
> > The highest dynamic address is E1000_TXDCTL(_n), as it define bellow:
> >
> > #define E1000_TXDCTL(_n) ((_n) < 4 ? (0x03828 + ((_n) * 0x100)) : \
> >                           (0x0E028 + ((_n) * 0x40)))
> >
> > But since the maximum _n we use in the e1000e driver is just 1, that address
> > maxes out at only 0x3928.
> >
> > So, since E1000_SYSSTMPH is the highest register offset the driver actually
> > accesses, how about we just define E1000_MMIO_LEN_MIN based on that?
> > Something like:
> >
> > /* Smallest BAR0 that covers every register the driver accesses */
> > #define E1000_MMIO_LEN_MIN	E1000_SYSSTMPH
>
> What is the size of this register? U32? Maybe you actually need:
>
> #define E1000_MMIO_LEN_MIN	E1000_SYSSTMPH + sizeof(u32)
>
> 	Andrew

yeah, in the e1000, these registers are all accessed via rd32 and wr32. 
I will respin new version soon. Thanks Andrew.