Patch "phy: marvell: a3700-comphy: Fix out of bounds read" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    phy: marvell: a3700-comphy: Fix out of bounds read

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c3cb0fce4262cdc2b1b86076317743264d2bc286
Author: Mikhail Kobuk <m.kobuk@xxxxxxxxx>
Date:   Thu Mar 21 19:47:30 2024 +0300

    phy: marvell: a3700-comphy: Fix out of bounds read
    
    [ Upstream commit e4308bc22b9d46cf33165c9dfaeebcf29cd56f04 ]
    
    There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr'
    every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'.
    
    Make sure 'gbe_phy_init[addr]' is used when all elements of
    'gbe_phy_init_fix' array are handled.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation")
    Signed-off-by: Mikhail Kobuk <m.kobuk@xxxxxxxxx>
    Reviewed-by: Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240321164734.49273-1-m.kobuk@xxxxxxxxx
    Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
index 24c3371e2bb29..e2d0bf92a9ada 100644
--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
+++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c
@@ -611,11 +611,12 @@ static void comphy_gbe_phy_init(struct mvebu_a3700_comphy_lane *lane,
 		 * comparison to 3.125 Gbps values. These register values are
 		 * stored in "gbe_phy_init_fix" array.
 		 */
-		if (!is_1gbps && gbe_phy_init_fix[fix_idx].addr == addr) {
+		if (!is_1gbps &&
+		    fix_idx < ARRAY_SIZE(gbe_phy_init_fix) &&
+		    gbe_phy_init_fix[fix_idx].addr == addr) {
 			/* Use new value */
 			val = gbe_phy_init_fix[fix_idx].value;
-			if (fix_idx < ARRAY_SIZE(gbe_phy_init_fix))
-				fix_idx++;
+			fix_idx++;
 		} else {
 			val = gbe_phy_init[addr];
 		}




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux