linux-kernel - Re: [net-next,v4,9/9] ice: dpll: Support E825-C SyncE and dynamic pin discovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260203161120.1894163-1-horms@kernel.org>
Date: Tue,  3 Feb 2026 16:11:20 +0000
From: Simon Horman <horms@...nel.org>
To: ivecera@...hat.com
Cc: Simon Horman <horms@...nel.org>,
	richardcochran@...il.com,
	arkadiusz.kubalewski@...el.com,
	przemyslaw.kitszel@...el.com,
	aleksandr.loktionov@...el.com,
	andrew+netdev@...n.ch,
	pabeni@...hat.com,
	saeedm@...dia.com,
	kuba@...nel.org,
	tariqt@...dia.com,
	netdev@...r.kernel.org,
	grzegorz.nitka@...el.com,
	poros@...hat.com,
	davem@...emloft.net,
	vadim.fedorenko@...ux.dev,
	linux-rdma@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	aleksander.lobakin@...el.com,
	jonathan.lemon@...il.com,
	jiri@...nulli.us,
	anthony.l.nguyen@...el.com,
	intel-wired-lan@...ts.osuosl.org,
	Prathosh.Satish@...rochip.com,
	leon@...nel.org,
	edumazet@...gle.com,
	mbloch@...dia.com
Subject: Re: [net-next,v4,9/9] ice: dpll: Support E825-C SyncE and dynamic pin discovery

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
ice: dpll: Support E825-C SyncE and dynamic pin discovery

This patch implements SyncE support for the E825-C Ethernet controller
using the DPLL subsystem, with dynamic pin discovery via firmware (ACPI)
and asynchronous registration using the DPLL notifier chain.

> diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c
> index 4eca62688d83..a8c99e49bfae 100644
> --- a/drivers/net/ethernet/intel/ice/ice_dpll.c
> +++ b/drivers/net/ethernet/intel/ice/ice_dpll.c

[ ... ]

> @@ -528,6 +529,92 @@ ice_dpll_pin_disable(struct ice_hw *hw, struct ice_dpll_pin *pin,
>  	return ret;
>  }
>
> +/**
> + * ice_dpll_rclk_update - updates the state of rclk pin on a device
> + * @pf: private board struct
> + * @pin: pointer to a pin
> + * @port_num: port number
> + *
> + * Update struct holding pin states info, states are separate for each parent
> + *
> + * Context: Called under pf->dplls.lock
> + * Return:
> + * * 0 - OK
> + * * negative - error
> + */
> +static int ice_dpll_rclk_update(struct ice_pf *pf, struct ice_dpll_pin *pin,
> +				u8 port_num)
> +{
> +	int ret;
> +
> +	for (u8 parent = 0; parent < pf->dplls.rclk.num_parents; parent++) {
> +		ret = ice_aq_get_phy_rec_clk_out(&pf->hw, &parent, &port_num,
> +						 &pin->flags[parent], NULL);

Is it safe to pass &parent as an output parameter when it's also the loop
counter? Looking at ice_aq_get_phy_rec_clk_out():

    int ice_aq_get_phy_rec_clk_out(struct ice_hw *hw, u8 *phy_output, ...)
    {
        cmd->phy_output = *phy_output;  // Read as input
        status = ice_aq_send_cmd(hw, &desc, NULL, 0, NULL);
        if (!status) {
            *phy_output = cmd->phy_output;  // Write back from firmware
        ...

The firmware could potentially return a different value than was sent,
which would be written back to 'parent', corrupting the loop counter.

This corrupted value is then used as an array index:

> +		if (ret)
> +			return ret;
> +
> +		ice_dpll_pin_store_state(pin, parent,
> +					 ICE_AQC_GET_PHY_REC_CLK_OUT_OUT_EN &
> +					 pin->flags[parent]);

Both pin->flags[parent] and pin->state[parent] (inside
ice_dpll_pin_store_state) could access out of bounds if firmware returns
a value >= ICE_DPLL_RCLK_NUM_MAX (which is 2).

Would it be safer to use a separate variable for the phy_output parameter
and validate that firmware echoes back the expected value?

> +	}
> +
> +	return 0;
> +}

[ ... ]

> @@ -3239,8 +3683,8 @@ static int ice_dpll_init_pins(struct ice_pf *pf, bool cgu)
>   * @d: pointer to ice_dpll
>   * @cgu: if cgu is present and controlled by this NIC
>   *
> - * If cgu is owned unregister the dpll from dpll subsystem.
> - * Release resources of dpll device from dpll subsystem.
> + * If cgu is owned, unregister the DPL from DPLL subsystem.
> + * Release resources of DPLL device from DPLL subsystem.
>   */

This isn't a bug, but there's a typo: 'DPL' should be 'DPLL'.