Skip to contentSkip to conversation

phy: add driver for Microsemi Ocelot SerDes muxing

bug report Dan Carpenter 2 participants 2 messages Oct 10, 2018 Kernel janitors

lore
Share & tools
lore
#0 lore raw

Hello Quentin Schulz,

The patch 51f6b410fc22: "phy: add driver for Microsemi Ocelot SerDes muxing" from Oct 4, 2018, leads to the following static checker warning:

	drivers/phy/mscc/phy-ocelot-serdes.c:210 serdes_simple_xlate()
	error: buffer overflow 'ctrl->phys' 8 <= 8

drivers/phy/mscc/phy-ocelot-serdes.c
197 static struct phy *serdes_simple_xlate(struct device *dev,
198 struct of_phandle_args *args)
199 {
200 struct serdes_ctrl *ctrl = dev_get_drvdata(dev);
201 unsigned int port, idx, i;
202
203 if (args->args_count != 2)
204 return ERR_PTR(-EINVAL);
205
206 port = args->args[0];
207 idx = args->args[1];
208

   209          for (i = 0; i <= SERDES_MAX; i++) {
                              ^^

Should this be < ?

   210                  struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]);
                                                                     ^^^^^^^^^^^^^

Or is this array too small?

   211  
   212                  if (idx != macro->idx)
   213                          continue;
   214  
   215                  /* SERDES6G(0) is the only SerDes capable of QSGMII */
   216                  if (idx != SERDES6G(0) && macro->port >= 0)
   217                          return ERR_PTR(-EBUSY);
   218  
   219                  macro->port = port;
   220                  return ctrl->phys[i];
   221          }
   222  
   223          return ERR_PTR(-ENODEV);
   224  }

regards,
dan carpenter

#1 lore raw

Hi Dan,

Quoted 30 lines · Dan Carpenter

Hello Quentin Schulz,

The patch 51f6b410fc22: "phy: add driver for Microsemi Ocelot SerDes muxing" from Oct 4, 2018, leads to the following static checker warning:

	drivers/phy/mscc/phy-ocelot-serdes.c:210 serdes_simple_xlate()
	error: buffer overflow 'ctrl->phys' 8 <= 8

drivers/phy/mscc/phy-ocelot-serdes.c
197 static struct phy *serdes_simple_xlate(struct device *dev,
198 struct of_phandle_args *args)

   199  {
   200          struct serdes_ctrl *ctrl = dev_get_drvdata(dev);
   201          unsigned int port, idx, i;
   202  
   203          if (args->args_count != 2)
   204                  return ERR_PTR(-EINVAL);
   205  
   206          port = args->args[0];
   207          idx = args->args[1];
   208  
   209          for (i = 0; i <= SERDES_MAX; i++) {
                              ^^

Should this be < ?

   210                  struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]);
                                                                     ^^^^^^^^^^^^^

Or is this array too small?

Quoted 15 lines
   211  
   212                  if (idx != macro->idx)
   213                          continue;
   214  
   215                  /* SERDES6G(0) is the only SerDes capable of QSGMII */
   216                  if (idx != SERDES6G(0) && macro->port >= 0)
   217                          return ERR_PTR(-EBUSY);
   218  
   219                  macro->port = port;
   220                  return ctrl->phys[i];
   221          }
   222  
   223          return ERR_PTR(-ENODEV);
   224  }

A patch has already been suggested.

Thanks,
Quentin