Re: [PATCH net-next v5 07/13] net: ethernet: oa_tc6: Add read_mms/write_mms register access functions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing SKB tailroom validation before skb_put() allows oversized frames to cause a kernel panic (DoS).
--

--- Patch [7]: [PATCH net-next v5 07/13] net: ethernet: oa_tc6: Add read_mms/write_mms register access functions ---
commit 1657b3f7ce65c20a46c5f26047b7e9b1c93b5265
Author: Ciprian Regus <ciprian.regus@analog.com>

net: ethernet: oa_tc6: Add read_mms/write_mms register access functions

The Open Alliance TC6 standard defines multiple memory maps for the
MAC-PHY's register space. Define register access functions that allow the
caller to specify the MMS.

> diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
> index 3c19233fb38f8..955148d3cefc4 100644
> --- a/drivers/net/ethernet/oa_tc6.c
> +++ b/drivers/net/ethernet/oa_tc6.c
> @@ -62,6 +62,8 @@
>  #define STATUS0_RESETC_POLL_DELAY		1000
>  #define STATUS0_RESETC_POLL_TIMEOUT		1000000
>  
> +#define OA_TC6_REG_MMS_MASK		GENMASK(19, 16)
> +

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for oversized
frames to cause a kernel panic due to a missing SKB tailroom check?

Looking at oa_tc6_update_rx_skb() in this file, it unconditionally calls
skb_put():

drivers/net/ethernet/oa_tc6.c:oa_tc6_update_rx_skb() {
	...
	memcpy(skb_put(tc6->rx_skb, length), payload, length);
}

This is fed by continuous chunks of an ongoing frame:

drivers/net/ethernet/oa_tc6.c:oa_tc6_prcs_ongoing_rx_frame() {
	...
	oa_tc6_update_rx_skb(tc6, payload, OA_TC6_CHUNK_PAYLOAD_SIZE);
}

If an oversized frame is received, or if the MAC-PHY streams continuous chunks
without asserting the end_valid flag, the driver reassembles the frame by
repeatedly calling oa_tc6_prcs_ongoing_rx_frame() and oa_tc6_update_rx_skb().

Since the SKB is allocated with a fixed size, and skb_put() is called
unconditionally without verifying skb_tailroom(), won't this overflow the
bounds and cause a panic via skb_over_panic()?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-adin1140-driver-v5-0-4aca7b51a58b@analog.com?part=7