public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: "Lucien.Jheng" <lucienzx159@gmail.com>
To: Andrew Lunn <andrew@lunn.ch>, Paolo Abeni <pabeni@redhat.com>
Cc: hkallweit1@gmail.com, linux@armlinux.org.uk, davem@davemloft.net,
	edumazet@google.com, kuba@kernel.org, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org, bjorn@mork.no, ericwouds@gmail.com,
	frank-w@public-files.de, daniel@makrotopia.org,
	lucien.jheng@airoha.com, albert-al.lee@airoha.com
Subject: Re: [PATCH v3] net: phy: air_en8811h: add AN8811HB MCU assert/deassert support
Date: Fri, 24 Apr 2026 23:57:57 +0800	[thread overview]
Message-ID: <6da66e31-3843-478c-9dd3-b2a9205026fd@gmail.com> (raw)
In-Reply-To: <18d653c9-e8fe-48ed-9524-869f79a63121@lunn.ch>


Andrew Lunn 於 2026/4/23 下午 07:58 寫道:
>>> @@ -1175,10 +1281,22 @@ static int an8811hb_probe(struct phy_device *phydev)
>>>   		return -ENOMEM;
>>>   	phydev->priv = priv;
>>>   
>>> +	mdiodev = mdio_device_create(phydev->mdio.bus,
>>> +				     phydev->mdio.addr + EN8811H_PBUS_ADDR_OFFS);
>> Sashiko says:
>>
>> Can this create an out-of-bounds array access if the base PHY address is
>> high?
>> The mdio_map array in struct mii_bus has a fixed size of PHY_MAX_ADDR (32).
>> If phydev->mdio.addr is 24 or higher, adding EN8811H_PBUS_ADDR_OFFS (8)
>> will result in an address of 32 or more.
>> Neither mdio_device_create() nor mdio_device_register() validate that
>> the address is within PHY_MAX_ADDR. When mdiobus_register_device()
>> executes mdiodev->bus->mdio_map[mdiodev->addr] = mdiodev, could this
>> write past the end of the array and corrupt adjacent memory?
> This has been discussed once, but Sashiko has a shorter memory than a
> goldfish. It is guaranteed by hardware design that + 8 will work.

Got it

Thanks

>
> 	  Andrew

  reply	other threads:[~2026-04-24 15:58 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-20 13:45 [PATCH v3] net: phy: air_en8811h: add AN8811HB MCU assert/deassert support Lucien.Jheng
2026-04-20 14:25 ` Bjørn Mork
2026-04-23 11:19 ` Paolo Abeni
2026-04-23 11:58   ` Andrew Lunn
2026-04-24 15:57     ` Lucien.Jheng [this message]
2026-04-24 15:56   ` Lucien.Jheng
2026-04-23 17:21 ` Jakub Kicinski
2026-04-24 15:59   ` Lucien.Jheng

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6da66e31-3843-478c-9dd3-b2a9205026fd@gmail.com \
    --to=lucienzx159@gmail.com \
    --cc=albert-al.lee@airoha.com \
    --cc=andrew@lunn.ch \
    --cc=bjorn@mork.no \
    --cc=daniel@makrotopia.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=ericwouds@gmail.com \
    --cc=frank-w@public-files.de \
    --cc=hkallweit1@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@armlinux.org.uk \
    --cc=lucien.jheng@airoha.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox