Evolution-X-Devices/kernel_xiaomi_garnet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "e1000e: fix heap overflow in e1000_set_eeprom"

Browse Source 
This reverts commit ce8829d3d4 which is
commit 90fb7db49c6dbac961c6b8ebfd741141ffbc8545 upstream.

It breaks the Android kernel build and can be brought back in the future
in an safe way if it is really needed.

Bug: 161946584
Change-Id: If032a8a05a75636df5400a494f08916e1b7e5e34
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman
2025-09-10 09:21:32 +00:00
parent be8ad78037
commit 45ade17078
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/ethernet/intel/e1000e/ethtool.c
View File

@@ -559,12 +559,12 @@ static int e1000_set_eeprom(struct net_device *netdev,
{
struct e1000_adapter *adapter = netdev_priv(netdev);
struct e1000_hw *hw = &adapter->hw;
size_t total_len, max_len;
u16 *eeprom_buff;
int ret_val = 0;
void *ptr;
int max_len;
int first_word;
int last_word;
void *ptr;
int ret_val = 0;
u16 i;
if (eeprom->len == 0)
@@ -579,10 +579,6 @@ static int e1000_set_eeprom(struct net_device *netdev,
max_len = hw->nvm.word_size * 2;
if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||
total_len > max_len)
return -EFBIG;
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
eeprom_buff = kmalloc(max_len, GFP_KERNEL);