github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: mdio: realtek-rtl9300: harden otto_emdio_map_ports()

Browse Source 
Due to its design the MDIO driver needs to set up a port to bus/address
mapping during probing. The "ethernet-ports" subnodes are scanned and
from the "phy-handle" property the MDIO nodes are looked up. In case of
a malformed device tree the driver might produce out-of-bounds accesses.
The PHY address is not checked against the maximum supported address.

Add a sanity check and drop the unneeded MAX_SMI_ADDR define.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://patch.msgid.link/20260603175924.123019-3-markus.stockhausen@gmx.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Markus Stockhausen 2026-06-03 19:59:19 +02:00 committed by Jakub Kicinski
parent f369dd8ccf
commit 829ee0f8bc
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/mdio/mdio-realtek-rtl9300.c
View File

@ -78,7 +78,6 @@
#define MAX_PORTS 28
#define MAX_SMI_BUSSES 4
#define MAX_SMI_ADDR 0x1f
#define RAW_PAGE(priv) ((priv)->info->num_pages - 1)
@ -430,8 +429,8 @@ static int otto_emdio_map_ports(struct device *dev)
struct device_node *ports_dn, *phy_dn, *bus_dn, *ctrl_dn;
struct otto_emdio_priv *priv = dev_get_drvdata(dev);
struct device *parent = dev->parent;
u32 addr, bus, pn;
int err = 0;
int addr, err = 0;
u32 bus, pn;
ports_dn = of_get_child_by_name(parent->of_node, "ethernet-ports");
if (!ports_dn)
@ -478,9 +477,11 @@ static int otto_emdio_map_ports(struct device *dev)
goto put_nodes;
}
err = of_property_read_u32(phy_dn, "reg", &addr);
if (err)
addr = of_mdio_parse_addr(dev, phy_dn);
if (addr < 0) {
err = addr;
goto put_nodes;
}
__set_bit(pn, priv->valid_ports);
priv->smi_bus[pn] = bus;