linux-kernel - Re: [PATCH net-next v6 1/3] net: dsa: yt921x: Fix MIB overflow wraparound routine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a5b78a79-8f8a-44d3-9a1e-1019ec57f910@redhat.com>
Date: Thu, 22 Jan 2026 10:41:16 +0100
From: Paolo Abeni <pabeni@...hat.com>
To: David Yang <mmyangfl@...il.com>, netdev@...r.kernel.org
Cc: Andrew Lunn <andrew@...n.ch>, Vladimir Oltean <olteanv@...il.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, linux-kernel@...r.kernel.org,
 Dan Carpenter <dan.carpenter@...aro.org>,
 David Laight <david.laight.linux@...il.com>
Subject: Re: [PATCH net-next v6 1/3] net: dsa: yt921x: Fix MIB overflow
 wraparound routine

On 1/18/26 2:30 AM, David Yang wrote:
> Reported by the following Smatch static checker warning:
> 
>   drivers/net/dsa/yt921x.c:702 yt921x_read_mib()
>   warn: was expecting a 64 bit value instead of '(~0)'
> 
> Fixes: 186623f4aa72 ("net: dsa: yt921x: Add support for Motorcomm YT921x")
> Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
> Closes: https://lore.kernel.org/netdev/aPsjYKQMzpY0nSXm@stanley.mountain/
> Suggested-by: David Laight <david.laight.linux@...il.com>
> Signed-off-by: David Yang <mmyangfl@...il.com>
> ---
>  drivers/net/dsa/yt921x.c | 15 ++++++++-------
>  1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/dsa/yt921x.c b/drivers/net/dsa/yt921x.c
> index 0b3df732c0d1..5e4e8093ba16 100644
> --- a/drivers/net/dsa/yt921x.c
> +++ b/drivers/net/dsa/yt921x.c
> @@ -682,21 +682,22 @@ static int yt921x_read_mib(struct yt921x_priv *priv, int port)
>  		const struct yt921x_mib_desc *desc = &yt921x_mib_descs[i];
>  		u32 reg = YT921X_MIBn_DATA0(port) + desc->offset;
>  		u64 *valp = &((u64 *)mib)[i];
> -		u64 val = *valp;
>  		u32 val0;
> -		u32 val1;
> +		u64 val;
>  
>  		res = yt921x_reg_read(priv, reg, &val0);
>  		if (res)
>  			break;
>  
>  		if (desc->size <= 1) {
> -			if (val < (u32)val)
> -				/* overflow */
> -				val += (u64)U32_MAX + 1;
> -			val &= ~U32_MAX;
> -			val |= val0;
> +			u64 old_val = *valp;

Why targeting net-next here? the blamed commit is already in Linus'tree
and it looks like the above could causes functional issues, ad the wrong
value is written into the mib.

I think this should go via net.

/P