Messages in this thread Patch in this message | | | From | Alvin Šipraga <> | Subject | Re: [PATCH net 1/2] net: dsa: realtek: fix out-of-bounds access | Date | Wed, 15 Mar 2023 13:21:35 +0000 |
| |
On Wed, Mar 15, 2023 at 02:09:15PM +0100, Ahmad Fatoum wrote: > The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) > with the expectation that priv has enough trailing space. > > However, only realtek-smi actually allocated this chip_data space. > Do likewise in realtek-mdio to fix out-of-bounds accesses. > > Fixes: aac94001067d ("net: dsa: realtek: add new mdio interface for drivers") > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> > ---
Reviewed-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Makes me wonder how the switches worked over MDIO all this time... I guess it was dumb luck.
> drivers/net/dsa/realtek/realtek-mdio.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/dsa/realtek/realtek-mdio.c b/drivers/net/dsa/realtek/realtek-mdio.c > index 3e54fac5f902..3b22d3f7ad99 100644 > --- a/drivers/net/dsa/realtek/realtek-mdio.c > +++ b/drivers/net/dsa/realtek/realtek-mdio.c > @@ -152,7 +152,7 @@ static int realtek_mdio_probe(struct mdio_device *mdiodev) > if (!var) > return -EINVAL; > > - priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL); > + priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv) + var->chip_data_sz, GFP_KERNEL); > if (!priv) > return -ENOMEM; > > -- > 2.30.2 > | |