netdev - Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0d51f36d-eee3-4455-a886-d6a979e8e891@sabinyo.mountain>
Date: Wed, 25 Jun 2025 10:23:17 -0500
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Jakub Raczynski <j.raczynski@...sung.com>
Cc: linux@...linux.org.uk, andrew@...n.ch, hkallweit1@...il.com,
	netdev@...r.kernel.org, Wenjing Shan <wenjing.shan@...sung.com>
Subject: Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write
 access

On Mon, Jun 09, 2025 at 05:31:46PM +0200, Jakub Raczynski wrote:
> When using publicly available tools like 'mdio-tools' to read/write data
> from/to network interface and its PHY via mdiobus, there is no verification of
> parameters passed to the ioctl and it accepts any mdio address.
> Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
> but it is possible to pass higher value than that via ioctl.
> While read/write operation should generally fail in this case,
> mdiobus provides stats array, where wrong address may allow out-of-bounds
> read/write.
> 
> Fix that by adding address verification before read/write operation.
> While this excludes this access from any statistics, it improves security of
> read/write operation.
> 
> Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics")
> Signed-off-by: Jakub Raczynski <j.raczynski@...sung.com>
> Reported-by: Wenjing Shan <wenjing.shan@...sung.com>
> ---
>  drivers/net/phy/mdio_bus.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
> index a6bcb0fee863..60fd0cd7cb9c 100644
> --- a/drivers/net/phy/mdio_bus.c
> +++ b/drivers/net/phy/mdio_bus.c
> @@ -445,6 +445,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)
>  
>  	lockdep_assert_held_once(&bus->mdio_lock);
>  
> +	if (addr >= PHY_MAX_ADDR)
> +		return -ENXIO;

addr is an int so Smatch wants this to be:

	if (addr < 0 || addr >= PHY_MAX_ADDR)
		return return -ENXIO;

I think that although addr is an int, the actual values are limited to
0-U16_MAX?

regards,
dan carpener