Re: [PATCH 1/2] net/mdiobus: Fix potential out-of-bounds read/write access

["Russell King (Oracle)" <linux@armlinux.org.uk>]

On Wed, Jun 25, 2025 at 10:23:17AM -0500, Dan Carpenter wrote:
> On Mon, Jun 09, 2025 at 05:31:46PM +0200, Jakub Raczynski wrote:
> > When using publicly available tools like 'mdio-tools' to read/write data
> > from/to network interface and its PHY via mdiobus, there is no verification of
> > parameters passed to the ioctl and it accepts any mdio address.
> > Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
> > but it is possible to pass higher value than that via ioctl.
> > While read/write operation should generally fail in this case,
> > mdiobus provides stats array, where wrong address may allow out-of-bounds
> > read/write.
> > 
> > Fix that by adding address verification before read/write operation.
> > While this excludes this access from any statistics, it improves security of
> > read/write operation.
> > 
> > Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics")
> > Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com>
> > Reported-by: Wenjing Shan <wenjing.shan@samsung.com>
> > ---
> >  drivers/net/phy/mdio_bus.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
> > index a6bcb0fee863..60fd0cd7cb9c 100644
> > --- a/drivers/net/phy/mdio_bus.c
> > +++ b/drivers/net/phy/mdio_bus.c
> > @@ -445,6 +445,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)
> >  
> >  	lockdep_assert_held_once(&bus->mdio_lock);
> >  
> > +	if (addr >= PHY_MAX_ADDR)
> > +		return -ENXIO;
> 
> addr is an int so Smatch wants this to be:
> 
> 	if (addr < 0 || addr >= PHY_MAX_ADDR)
> 		return return -ENXIO;
> 
> I think that although addr is an int, the actual values are limited to
> 0-U16_MAX?

0 to 31 inclusive.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!