[PATCH net-next 2/2] net: pcs: rzn1-miic: Validate dtb configuration values
From: Kyle Hendry via B4 Relay <devnull+khendry.reliablecontrols.com@kernel.org>
Date: 2026-09-25 15:12:31
Also in:
b4-sent, linux-renesas-soc, lkml
Subsystem:
ethernet phy library, networking drivers, renesas rz/n1 a5psw switch driver, the rest · Maintainers:
Andrew Lunn, Heiner Kallweit, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Clément Léger, Linus Torvalds
From: Kyle Hendry <redacted> Bad configuration values from the dtb could result in out of bounds array access. Verify that parsed values are within range for the SoC and fail the probe if they are invalid. Signed-off-by: Kyle Hendry <redacted> --- drivers/net/pcs/pcs-rzn1-miic.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
index 62daaf76e052..30ac2d407005 100644
--- a/drivers/net/pcs/pcs-rzn1-miic.c
+++ b/drivers/net/pcs/pcs-rzn1-miic.c@@ -695,9 +695,24 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg) if (of_property_read_u32(conv, "reg", &port)) continue; + if (port < miic->of_data->miic_port_start || + port > MIIC_PORT_END(miic->of_data)) { + dev_err(miic->dev, "Port number out of range: %d\n", port); + of_node_put(conv); + ret = -EINVAL; + goto err; + } + if (of_property_read_u32(conv, "renesas,miic-input", &conf)) continue; + if (conf >= miic->of_data->conf_to_string_count) { + dev_err(miic->dev, "Port configuration out of range: %d\n", conf); + of_node_put(conv); + ret = -EINVAL; + goto err; + } + /* Adjust for 0 based index */ dt_val[port + !miic->of_data->miic_port_start] = conf;
@@ -707,6 +722,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg) } ret = miic_match_dt_conf(miic, dt_val, mode_cfg); +err: kfree(dt_val); return ret;
--
2.43.0