From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 07 Mar 2023 11:16:18 +0100 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1pZUMj-00CCid-RF for lore@lore.pengutronix.de; Tue, 07 Mar 2023 11:16:18 +0100 Received: from bombadil.infradead.org ([2607:7c80:54:3::133]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pZUMj-0007zV-M2 for lore@pengutronix.de; Tue, 07 Mar 2023 11:16:18 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=dTqFgi0Kot1QBPuBptrMIYWfKMyChnSPrLeGureQyc8=; b=CkJH3Zqx7i+gYDQPPQeJxGR4go 60gHIAMAhkmgNttsr991EdnKMk3uTnpuH5OnqCp58ba8JvzgRGIsj6Ddb1C9FWkWnfOq4LWz076Av nBjxLnjw2ZtZsfZ1YG8keIHRfWr22+ypP8dpZ2qz+FvpJrdBqTIzbCQYYx6KWsOUxE8s2I7PGqOG2 +ZyBRbAkpZwXoP/3NxrGNOe9i6yY5azie3hjR7b5sBj4KFlsgtz54l/YB+p3zM/c/sP37xdENWfPR HNFDf8kBWv9bryTlmg42Iam/YpfeQbFaEVLCshdaBZeQpoiUEkqcXL5hYwr3inS8OgpaEO/ATKLLh pshfdKrA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1pZULW-00HBcF-Bz; Tue, 07 Mar 2023 10:15:02 +0000 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1pZULL-00HBYg-GG for barebox@lists.infradead.org; Tue, 07 Mar 2023 10:14:54 +0000 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pZULJ-0007Mm-Or; Tue, 07 Mar 2023 11:14:49 +0100 Received: from [2a0a:edc0:0:1101:1d::54] (helo=dude05.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.94.2) (envelope-from ) id 1pZULJ-002SWa-3y; Tue, 07 Mar 2023 11:14:49 +0100 Received: from afa by dude05.red.stw.pengutronix.de with local (Exim 4.94.2) (envelope-from ) id 1pZULH-008iWf-RG; Tue, 07 Mar 2023 11:14:47 +0100 From: Ahmad Fatoum To: barebox@lists.infradead.org Cc: Ahmad Fatoum Date: Tue, 7 Mar 2023 11:14:43 +0100 Message-Id: <20230307101446.2077676-2-a.fatoum@pengutronix.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230307101446.2077676-1-a.fatoum@pengutronix.de> References: <20230307101446.2077676-1-a.fatoum@pengutronix.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230307_021451_601225_68873183 X-CRM114-Status: GOOD ( 13.53 ) X-BeenThere: barebox@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "barebox" X-SA-Exim-Connect-IP: 2607:7c80:54:3::133 X-SA-Exim-Mail-From: barebox-bounces+lore=pengutronix.de@lists.infradead.org X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.ext.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-4.8 required=4.0 tests=AWL,BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,SPF_HELO_NONE,SPF_NONE, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.2 Subject: [PATCH master 2/5] net: dsa: realtek: mdio: fix out-of-bounds memory write X-SA-Exim-Version: 4.2.1 (built Wed, 08 May 2019 21:11:16 +0000) X-SA-Exim-Scanned: Yes (on metis.ext.pengutronix.de) The SMI Realtek driver takes care of chip_data_sz as expected, but the MDIO driver doesn't, leading to memory corruption. Fix this. This issue is also present in the original Linux driver and will be fixed there as well. Signed-off-by: Ahmad Fatoum --- drivers/net/realtek-dsa/realtek-mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/realtek-dsa/realtek-mdio.c b/drivers/net/realtek-dsa/realtek-mdio.c index 7c26841d2fac..8b32c3cf539e 100644 --- a/drivers/net/realtek-dsa/realtek-mdio.c +++ b/drivers/net/realtek-dsa/realtek-mdio.c @@ -119,7 +119,7 @@ static int realtek_mdio_probe(struct phy_device *mdiodev) if (!var) return -EINVAL; - priv = kzalloc(sizeof(*priv), GFP_KERNEL); + priv = kzalloc(sizeof(*priv) + var->chip_data_sz, GFP_KERNEL); if (!priv) return -ENOMEM; -- 2.30.2