DF-1147
EEPROM read timeout detection broken by loop/check bound mismatch
Summary
bnx_eeprom_getbyte at if_bnx.c:438 loops i<BNX_TIMEOUT*10 (50000) but exhaustion test at :444 compares i==BNX_TIMEOUT (5000) -> never matches -> falls through to return BGE_EE_DATA as success on timeout. Every other poll loop in file correctly matches bound with check. Boot-time only. Slow/faulty EEPROM yields garbage MAC or hwcfg without error. Fix: change test to i==BNX_TIMEOUT*10.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1147 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 392 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/netif/bnx/if_bnx.c:438: EEPROM read timeout detection broken by loop/check bound mismatch
Verified recommended fix
Source-confirmed at sys/dev/netif/bnx/if_bnx.c:438: EEPROM read timeout detection broken by loop/check bound mismatch
Verdict
Source-confirmed at sys/dev/netif/bnx/if_bnx.c:438: EEPROM read timeout detection broken by loop/check bound mismatch
No comments yet.