Re: CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom

[Tony Nguyen <anthony.l.nguyen@intel.com>]

On 10/27/2025 2:46 PM, Andrew Lunn wrote:
>> we believe that this CVE is invalid since the sole caller is
>> `net/ethtool/ioctl.c:ethtool_set_eeprom()`, which already does all the
>> necessary checks before invoking a driver specific implementation.
> 
> It is either invalid, or the fix is only fixing e1000, and very
> likely, the same issue exists in lots of other drivers, so the fix is
> wrong and should be done somewhere else...
> 
> This fix adds to the e1000e driver:
> 
> +       if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||
> +           total_len > max_len)
> +               return -EFBIG;
> 
> In the core, ethtool_set_eeprom() we have:
> 
>         /* Check for wrap and zero */
>          if (eeprom.offset + eeprom.len <= eeprom.offset)
>                  return -EINVAL;
> 
>          /* Check for exceeding total eeprom len */
>          if (eeprom.offset + eeprom.len > ops->get_eeprom_len(dev))
>                  return -EINVAL;
> 
> Are they equivalent? Is the core broken?

The checks in ethtool_set_eeprom() look to be equivalent to what we were 
adding to e1000e so I think core checks are sufficient, and the e1000e 
ones, unneeded.

Thanks,
Tony

> 
> I will leave it to somebody who understands wraparound to decide.
> 
> 	Andrew