lkml.org 
[lkml]   [2021]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 024/130] net: tulip: de4x5: fix the problem that the array lp->phy[8] may be out of bound
    Date
    From: zhangyue <zhangyue1@kylinos.cn>

    [ Upstream commit 61217be886b5f7402843677e4be7e7e83de9cb41 ]

    In line 5001, if all id in the array 'lp->phy[8]' is not 0, when the
    'for' end, the 'k' is 8.

    At this time, the array 'lp->phy[8]' may be out of bound.

    Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/dec/tulip/de4x5.c | 30 +++++++++++++++-----------
    1 file changed, 17 insertions(+), 13 deletions(-)

    diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
    index 683e328b5461d..ffc25ecfa8d6a 100644
    --- a/drivers/net/ethernet/dec/tulip/de4x5.c
    +++ b/drivers/net/ethernet/dec/tulip/de4x5.c
    @@ -4997,19 +4997,23 @@ mii_get_phy(struct net_device *dev)
    }
    if ((j == limit) && (i < DE4X5_MAX_MII)) {
    for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
    - lp->phy[k].addr = i;
    - lp->phy[k].id = id;
    - lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */
    - lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */
    - lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */
    - lp->mii_cnt++;
    - lp->active++;
    - printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name);
    - j = de4x5_debug;
    - de4x5_debug |= DEBUG_MII;
    - de4x5_dbg_mii(dev, k);
    - de4x5_debug = j;
    - printk("\n");
    + if (k < DE4X5_MAX_PHY) {
    + lp->phy[k].addr = i;
    + lp->phy[k].id = id;
    + lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */
    + lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */
    + lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */
    + lp->mii_cnt++;
    + lp->active++;
    + printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name);
    + j = de4x5_debug;
    + de4x5_debug |= DEBUG_MII;
    + de4x5_dbg_mii(dev, k);
    + de4x5_debug = j;
    + printk("\n");
    + } else {
    + goto purgatory;
    + }
    }
    }
    purgatory:
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-12-06 16:30    [W:4.155 / U:1.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site