e1000_probe() ioremaps BAR 0 and then accesses it through writel()/readl()
(e.g. __ew32() in netdev.c and er32(EEMNGCTL)/er32(STATUS) on 82571 parts)
without first checking that BAR 0 is actually a memory resource large
enough to hold the register space.  A device exposing a short or non-memory
BAR 0 would make those register accesses fall outside the mapping.

Validate that BAR 0 has IORESOURCE_MEM set and is at least 64 KiB (which
covers the largest register offset the driver touches) before ioremapping
it, and abort the probe with -EIO otherwise.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 844f31ab37ad..f73e4da5be5d 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -7449,7 +7449,17 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
     mmio_start = pci_resource_start(pdev, 0);
     mmio_len = pci_resource_len(pdev, 0);
 
+    /* BAR 0 must be a memory resource large enough to hold the full
+     * device register space (at most 64 KiB) before it is ioremapped
+     * and accessed via readl()/writel().
+     */
     err = -EIO;
+    if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM) ||
+        mmio_len < 0x10000) {
+        dev_err(&pdev->dev, "Invalid MMIO resource for BAR 0, aborting\n");
+        goto err_ioremap;
+    }
+
     adapter->hw.hw_addr = ioremap(mmio_start, mmio_len);
     if (!adapter->hw.hw_addr)
         goto err_ioremap;