netdev - Re: [PATCH v2 net-next] net: stmmac: mdio: use phy_find_first to simplify stmmac_mdio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aPY9H0zTwhCWTmXK@horms.kernel.org>
Date: Mon, 20 Oct 2025 14:46:07 +0100
From: Simon Horman <horms@...nel.org>
To: Heiner Kallweit <hkallweit1@...il.com>
Cc: Andrew Lunn <andrew+netdev@...n.ch>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>, David Miller <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Maxime Coquelin <mcoquelin.stm32@...il.com>,
	Alexandre Torgue <alexandre.torgue@...s.st.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Russell King - ARM Linux <linux@...linux.org.uk>,
	"moderated list:ARM/STM32 ARCHITECTURE" <linux-stm32@...md-mailman.stormreply.com>,
	"linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH v2 net-next] net: stmmac: mdio: use phy_find_first to
 simplify stmmac_mdio_register

On Sat, Oct 18, 2025 at 08:48:07PM +0200, Heiner Kallweit wrote:

...

> @@ -668,41 +669,31 @@ int stmmac_mdio_register(struct net_device *ndev)

...

> +	phydev = phy_find_first(new_bus);
> +	if (!phydev || phydev->mdio.addr > max_addr) {

Hi Heiner,

Depending on logic earlier in this function max_addr may be PHY_MAX_ADDR (32).

>  		dev_warn(dev, "No PHY found\n");
>  		err = -ENODEV;
>  		goto no_phy_found;
>  	}
>  
> +	/*
> +	 * If an IRQ was provided to be assigned after
> +	 * the bus probe, do it here.
> +	 */
> +	if (!mdio_bus_data->irqs && mdio_bus_data->probed_phy_irq > 0) {
> +		new_bus->irq[phydev->mdio.addr] = mdio_bus_data->probed_phy_irq;

And new_bus->irq is an array with PHY_MAX_ADDR elements.

So if phydev->mdio.addr and max_addr are both PHY_MAX_ADDR,
then the if condition above my first comment will not be met,
and it seems that the access would irq[] may overflow.

Perhaps this can't occur. But It does seem worth bringing to your attention.

Flagged by Smatch.

> +		phydev->irq = mdio_bus_data->probed_phy_irq;
> +	}
> +
> +	/*
> +	 * If we're going to bind the MAC to this PHY bus, and no PHY number
> +	 * was provided to the MAC, use the one probed here.
> +	 */
> +	if (priv->plat->phy_addr == -1)
> +		priv->plat->phy_addr = phydev->mdio.addr;
> +
> +	phy_attached_info(phydev);
> +
>  bus_register_done:
>  	priv->mii = new_bus;

...