| From feaf26b031a21a875c84dd06b92e34ed0f951220 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 18 Nov 2021 13:46:32 +0800 |
| Subject: net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be |
| out of bound |
| |
| From: zhangyue <zhangyue1@kylinos.cn> |
| |
| [ Upstream commit 61217be886b5f7402843677e4be7e7e83de9cb41 ] |
| |
| In line 5001, if all id in the array 'lp->phy[8]' is not 0, when the |
| 'for' end, the 'k' is 8. |
| |
| At this time, the array 'lp->phy[8]' may be out of bound. |
| |
| Signed-off-by: zhangyue <zhangyue1@kylinos.cn> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/dec/tulip/de4x5.c | 30 +++++++++++++++----------- |
| 1 file changed, 17 insertions(+), 13 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c |
| index 7799cf33cc6e2..7c4150a83a082 100644 |
| --- a/drivers/net/ethernet/dec/tulip/de4x5.c |
| +++ b/drivers/net/ethernet/dec/tulip/de4x5.c |
| @@ -4992,19 +4992,23 @@ mii_get_phy(struct net_device *dev) |
| } |
| if ((j == limit) && (i < DE4X5_MAX_MII)) { |
| for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++); |
| - lp->phy[k].addr = i; |
| - lp->phy[k].id = id; |
| - lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */ |
| - lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */ |
| - lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */ |
| - lp->mii_cnt++; |
| - lp->active++; |
| - printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name); |
| - j = de4x5_debug; |
| - de4x5_debug |= DEBUG_MII; |
| - de4x5_dbg_mii(dev, k); |
| - de4x5_debug = j; |
| - printk("\n"); |
| + if (k < DE4X5_MAX_PHY) { |
| + lp->phy[k].addr = i; |
| + lp->phy[k].id = id; |
| + lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */ |
| + lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */ |
| + lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */ |
| + lp->mii_cnt++; |
| + lp->active++; |
| + printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name); |
| + j = de4x5_debug; |
| + de4x5_debug |= DEBUG_MII; |
| + de4x5_dbg_mii(dev, k); |
| + de4x5_debug = j; |
| + printk("\n"); |
| + } else { |
| + goto purgatory; |
| + } |
| } |
| } |
| purgatory: |
| -- |
| 2.33.0 |
| |