linux-kernel - [PATCH 1/2] net: dsa: microchip: set the correct number of ports in dsa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Jul 2020 19:51:27 +0300
From:   Codrin Ciubotariu <codrin.ciubotariu@...rochip.com>
To:     <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC:     <woojung.huh@...rochip.com>, <UNGLinuxDriver@...rochip.com>,
        <andrew@...n.ch>, <vivien.didelot@...il.com>,
        <f.fainelli@...il.com>, <davem@...emloft.net>, <kuba@...nel.org>,
        <nicolas.ferre@...rochip.com>,
        Codrin Ciubotariu <codrin.ciubotariu@...rochip.com>
Subject: [PATCH 1/2] net: dsa: microchip: set the correct number of ports in dsa_switch

The number of ports is incorrectly set to the maximum available for a DSA
switch. Even if the extra ports are not used, this causes some functions
to be called later, like port_disable() and port_stp_state_set(). If the
driver doesn't check the port index, it will end up modifying unknown
registers.

Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477")
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@...rochip.com>
---
 drivers/net/dsa/microchip/ksz8795.c    |  7 +++++--
 drivers/net/dsa/microchip/ksz9477.c    |  7 +++++--
 drivers/net/dsa/microchip/ksz_common.c | 26 ++++++++++++++++----------
 drivers/net/dsa/microchip/ksz_common.h |  1 +
 4 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/drivers/net/dsa/microchip/ksz8795.c b/drivers/net/dsa/microchip/ksz8795.c
index 47d65b77caf7..b0227b0e31e6 100644
--- a/drivers/net/dsa/microchip/ksz8795.c
+++ b/drivers/net/dsa/microchip/ksz8795.c
@@ -1225,8 +1225,6 @@ static int ksz8795_switch_init(struct ksz_device *dev)
 {
 	int i;
 
-	dev->ds->ops = &ksz8795_switch_ops;
-
 	for (i = 0; i < ARRAY_SIZE(ksz8795_switch_chips); i++) {
 		const struct ksz_chip_data *chip = &ksz8795_switch_chips[i];
 
@@ -1268,6 +1266,11 @@ static int ksz8795_switch_init(struct ksz_device *dev)
 			return -ENOMEM;
 	}
 
+	dev->ds = ksz_dsa_switch_alloc(dev);
+	if (!dev->ds)
+		return -ENOMEM;
+	dev->ds->ops = &ksz8795_switch_ops;
+
 	return 0;
 }
 
diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c
index 9a51b8a4de5d..833cf3763000 100644
--- a/drivers/net/dsa/microchip/ksz9477.c
+++ b/drivers/net/dsa/microchip/ksz9477.c
@@ -1545,8 +1545,6 @@ static int ksz9477_switch_init(struct ksz_device *dev)
 {
 	int i;
 
-	dev->ds->ops = &ksz9477_switch_ops;
-
 	for (i = 0; i < ARRAY_SIZE(ksz9477_switch_chips); i++) {
 		const struct ksz_chip_data *chip = &ksz9477_switch_chips[i];
 
@@ -1588,6 +1586,11 @@ static int ksz9477_switch_init(struct ksz_device *dev)
 			return -ENOMEM;
 	}
 
+	dev->ds = ksz_dsa_switch_alloc(dev);
+	if (!dev->ds)
+		return -ENOMEM;
+	dev->ds->ops = &ksz9477_switch_ops;
+
 	return 0;
 }
 
diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index fd1d6676ae4f..4a41f0c7dbbc 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -387,30 +387,36 @@ EXPORT_SYMBOL_GPL(ksz_disable_port);
 
 struct ksz_device *ksz_switch_alloc(struct device *base, void *priv)
 {
-	struct dsa_switch *ds;
 	struct ksz_device *swdev;
 
-	ds = devm_kzalloc(base, sizeof(*ds), GFP_KERNEL);
-	if (!ds)
-		return NULL;
-
-	ds->dev = base;
-	ds->num_ports = DSA_MAX_PORTS;
-
 	swdev = devm_kzalloc(base, sizeof(*swdev), GFP_KERNEL);
 	if (!swdev)
 		return NULL;
 
-	ds->priv = swdev;
 	swdev->dev = base;
 
-	swdev->ds = ds;
 	swdev->priv = priv;
 
 	return swdev;
 }
 EXPORT_SYMBOL(ksz_switch_alloc);
 
+struct dsa_switch *ksz_dsa_switch_alloc(struct ksz_device *swdev)
+{
+	struct dsa_switch *ds;
+
+	ds = devm_kzalloc(swdev->dev, sizeof(*ds), GFP_KERNEL);
+	if (!ds)
+		return NULL;
+
+	ds->dev = swdev->dev;
+	ds->num_ports = swdev->port_cnt;
+	ds->priv = swdev;
+
+	return ds;
+}
+EXPORT_SYMBOL(ksz_dsa_switch_alloc);
+
 int ksz_switch_register(struct ksz_device *dev,
 			const struct ksz_dev_ops *ops)
 {
diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h
index f2c9bb68fd33..785702514a46 100644
--- a/drivers/net/dsa/microchip/ksz_common.h
+++ b/drivers/net/dsa/microchip/ksz_common.h
@@ -145,6 +145,7 @@ struct ksz_dev_ops {
 };
 
 struct ksz_device *ksz_switch_alloc(struct device *base, void *priv);
+struct dsa_switch *ksz_dsa_switch_alloc(struct ksz_device *swdev);
 int ksz_switch_register(struct ksz_device *dev,
 			const struct ksz_dev_ops *ops);
 void ksz_switch_remove(struct ksz_device *dev);
-- 
2.25.1