netdev - Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250626085534eucms1p384ebc44f8f5b2c5bab9b7431512dc45b@eucms1p3>
Date: Thu, 26 Jun 2025 10:55:34 +0200
From: Jakub Raczynski <j.raczynski@...sung.com>
To: "Russell King (Oracle)" <linux@...linux.org.uk>
CC: Dan Carpenter <dan.carpenter@...aro.org>, "andrew@...n.ch"
	<andrew@...n.ch>, "hkallweit1@...il.com" <hkallweit1@...il.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, Wenjing Shan
	<wenjing.shan@...sung.com>
Subject: Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write
 access

On Wed, Jun 25, 2025 at 10:23:17AM -0500, Dan Carpenter wrote:
> On Mon, Jun 09, 2025 at 05:31:46PM +0200, Jakub Raczynski wrote:
> > > When using publicly available tools like 'mdio-tools' to read/write data
> > > from/to network interface and its PHY via mdiobus, there is no verification of
> > > parameters passed to the ioctl and it accepts any mdio address.
> > > Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
> > > but it is possible to pass higher value than that via ioctl.
> > > While read/write operation should generally fail in this case,
> > > mdiobus provides stats array, where wrong address may allow out-of-bounds
> > > read/write.
> > >
> > > Fix that by adding address verification before read/write operation.
> > > While this excludes this access from any statistics, it improves security of
> > > read/write operation.
> > >
> > > Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics")
> > > Signed-off-by: Jakub Raczynski <j.raczynski@...sung.com>
> > > Reported-by: Wenjing Shan <wenjing.shan@...sung.com>
> > > ---
> > >  drivers/net/phy/mdio_bus.c 6 ++++++
> > >  1 file changed, 6 insertions(+)
> > >
> > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
> > > index a6bcb0fee863..60fd0cd7cb9c 100644
> > > --- a/drivers/net/phy/mdio_bus.c
> > > +++ b/drivers/net/phy/mdio_bus.c
> > > @@ -445,6 +445,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)
> > > 
> > >         lockdep_assert_held_once(&bus->mdio_lock);
> > > 
> > > +        if (addr >= PHY_MAX_ADDR)
> > > +                return -ENXIO;
> >
> > addr is an int so Smatch wants this to be:
> >
> >         if (addr < 0 addr >= PHY_MAX_ADDR)
> >                 return return -ENXIO;
> >
> > I think that although addr is an int, the actual values are limited to
> > 0-U16_MAX?

> 0 to 31 inclusive.

Should not be an issue. User calls use struct mii_ioctl_data which forces type of u16 so should not be a case. And some drivers force it too. Probably proper fix would be converting addr parameter to u16 to have consistent API.