netdev - Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <09617c9f-8c78-4ec2-8f29-fbbd481baf06@lunn.ch>
Date: Wed, 25 Jun 2025 18:38:14 +0200
From: Andrew Lunn <andrew@...n.ch>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Jakub Raczynski <j.raczynski@...sung.com>, linux@...linux.org.uk,
	hkallweit1@...il.com, netdev@...r.kernel.org,
	Wenjing Shan <wenjing.shan@...sung.com>
Subject: Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write
 access

On Wed, Jun 25, 2025 at 10:23:17AM -0500, Dan Carpenter wrote:
> On Mon, Jun 09, 2025 at 05:31:46PM +0200, Jakub Raczynski wrote:
> > When using publicly available tools like 'mdio-tools' to read/write data
> > from/to network interface and its PHY via mdiobus, there is no verification of
> > parameters passed to the ioctl and it accepts any mdio address.
> > Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
> > but it is possible to pass higher value than that via ioctl.
> > While read/write operation should generally fail in this case,
> > mdiobus provides stats array, where wrong address may allow out-of-bounds
> > read/write.
> > 
> > Fix that by adding address verification before read/write operation.
> > While this excludes this access from any statistics, it improves security of
> > read/write operation.
> > 
> > Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics")
> > Signed-off-by: Jakub Raczynski <j.raczynski@...sung.com>
> > Reported-by: Wenjing Shan <wenjing.shan@...sung.com>
> > ---
> >  drivers/net/phy/mdio_bus.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
> > index a6bcb0fee863..60fd0cd7cb9c 100644
> > --- a/drivers/net/phy/mdio_bus.c
> > +++ b/drivers/net/phy/mdio_bus.c
> > @@ -445,6 +445,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)
> >  
> >  	lockdep_assert_held_once(&bus->mdio_lock);
> >  
> > +	if (addr >= PHY_MAX_ADDR)
> > +		return -ENXIO;
> 
> addr is an int so Smatch wants this to be:
> 
> 	if (addr < 0 || addr >= PHY_MAX_ADDR)
> 		return return -ENXIO;

Yes, addr should never be negative.

> I think that although addr is an int, the actual values are limited to
> 0-U16_MAX?

No, addr should be in the range 0-31. regnum should also be in the
range 0-31. These are clause 22 accesses. There are also clause 45
accesses, but they don't come through here. For those, addr is still
in the range 0-31, but regnum is 0-U16_MAX.

	Andrew