| From 6c9000bc5c078277614e953a0f2eca943ce4e998 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 18 Aug 2025 17:45:07 +0900 |
| Subject: net: usb: asix_devices: Fix PHY address mask in MDIO bus |
| initialization |
| |
| From: Yuichiro Tsuji <yuichtsu@amazon.com> |
| |
| [ Upstream commit 24ef2f53c07f273bad99173e27ee88d44d135b1c ] |
| |
| Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. |
| |
| The PHY address should be masked to 5 bits (0-31). Without this |
| mask, invalid PHY addresses could be used, potentially causing issues |
| with MDIO bus operations. |
| |
| Fix this by masking the PHY address with 0x1f (31 decimal) to ensure |
| it stays within the valid range. |
| |
| Fixes: 4faff70959d5 ("net: usb: asix_devices: add phy_mask for ax88772 mdio bus") |
| Reported-by: syzbot+20537064367a0f98d597@syzkaller.appspotmail.com |
| Closes: https://syzkaller.appspot.com/bug?extid=20537064367a0f98d597 |
| Tested-by: syzbot+20537064367a0f98d597@syzkaller.appspotmail.com |
| Signed-off-by: Yuichiro Tsuji <yuichtsu@amazon.com> |
| Reviewed-by: Andrew Lunn <andrew@lunn.ch> |
| Link: https://patch.msgid.link/20250818084541.1958-1-yuichtsu@amazon.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/usb/asix_devices.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c |
| index d1813a2495bc..021f38c25be8 100644 |
| --- a/drivers/net/usb/asix_devices.c |
| +++ b/drivers/net/usb/asix_devices.c |
| @@ -676,7 +676,7 @@ static int ax88772_init_mdio(struct usbnet *dev) |
| priv->mdio->read = &asix_mdio_bus_read; |
| priv->mdio->write = &asix_mdio_bus_write; |
| priv->mdio->name = "Asix MDIO Bus"; |
| - priv->mdio->phy_mask = ~(BIT(priv->phy_addr) | BIT(AX_EMBD_PHY_ADDR)); |
| + priv->mdio->phy_mask = ~(BIT(priv->phy_addr & 0x1f) | BIT(AX_EMBD_PHY_ADDR)); |
| /* mii bus name is usb-<usb bus number>-<usb device number> */ |
| snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", |
| dev->udev->bus->busnum, dev->udev->devnum); |
| -- |
| 2.50.1 |
| |
