From: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
To: intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org
Subject: [PATCH iwl-next v4 4/6] ice: dpll: Check for bounds when updating the pin states
Date: Wed, 26 Aug 2026 09:48:47 +0000 [thread overview]
Message-ID: <20260826094849.4112016-5-sergey.temerkhanov@intel.com> (raw)
In-Reply-To: <20260826094849.4112016-1-sergey.temerkhanov@intel.com>
Add bounds checking code so that any potential out-of-bound
array access is avoided
Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
---
drivers/net/ethernet/intel/ice/ice_dpll.c | 46 +++++++++++++----------
1 file changed, 26 insertions(+), 20 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c
index f4d6c247e96e..e80460aeac11 100644
--- a/drivers/net/ethernet/intel/ice/ice_dpll.c
+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c
@@ -758,6 +758,8 @@ ice_dpll_pin_state_update(struct ice_pf *pf, struct ice_dpll_pin *pin,
struct netlink_ext_ack *extack)
{
u8 parent, port_num = ICE_AQC_SET_PHY_REC_CLK_OUT_CURR_PORT;
+ enum dpll_pin_state eec_state = DPLL_PIN_STATE_DISCONNECTED;
+ enum dpll_pin_state pps_state = DPLL_PIN_STATE_DISCONNECTED;
int ret;
switch (pin_type) {
@@ -769,26 +771,26 @@ ice_dpll_pin_state_update(struct ice_pf *pf, struct ice_dpll_pin *pin,
goto err;
if (ICE_AQC_GET_CGU_IN_CFG_FLG2_INPUT_EN & pin->flags[0]) {
if (pin->pin) {
- pin->state[pf->dplls.eec.dpll_idx] =
+ eec_state =
pin->pin == pf->dplls.eec.active_input ?
DPLL_PIN_STATE_CONNECTED :
DPLL_PIN_STATE_SELECTABLE;
- pin->state[pf->dplls.pps.dpll_idx] =
+ pps_state =
pin->pin == pf->dplls.pps.active_input ?
DPLL_PIN_STATE_CONNECTED :
DPLL_PIN_STATE_SELECTABLE;
} else {
- pin->state[pf->dplls.eec.dpll_idx] =
- DPLL_PIN_STATE_SELECTABLE;
- pin->state[pf->dplls.pps.dpll_idx] =
- DPLL_PIN_STATE_SELECTABLE;
+ eec_state = DPLL_PIN_STATE_SELECTABLE;
+ pps_state = DPLL_PIN_STATE_SELECTABLE;
}
- } else {
- pin->state[pf->dplls.eec.dpll_idx] =
- DPLL_PIN_STATE_DISCONNECTED;
- pin->state[pf->dplls.pps.dpll_idx] =
- DPLL_PIN_STATE_DISCONNECTED;
}
+ /* Commit only after a successful read so lockless readers never
+ * observe a transient disconnected state.
+ */
+ if (pf->dplls.eec.dpll_idx < ICE_DPLL_RCLK_NUM_MAX)
+ pin->state[pf->dplls.eec.dpll_idx] = eec_state;
+ if (pf->dplls.pps.dpll_idx < ICE_DPLL_RCLK_NUM_MAX)
+ pin->state[pf->dplls.pps.dpll_idx] = pps_state;
break;
case ICE_DPLL_PIN_TYPE_OUTPUT:
ret = ice_aq_get_output_pin_cfg(&pf->hw, pin->idx,
@@ -799,20 +801,17 @@ ice_dpll_pin_state_update(struct ice_pf *pf, struct ice_dpll_pin *pin,
parent &= ICE_AQC_GET_CGU_OUT_CFG_DPLL_SRC_SEL;
if (ICE_AQC_GET_CGU_OUT_CFG_OUT_EN & pin->flags[0]) {
- pin->state[pf->dplls.eec.dpll_idx] =
- parent == pf->dplls.eec.dpll_idx ?
+ eec_state = parent == pf->dplls.eec.dpll_idx ?
DPLL_PIN_STATE_CONNECTED :
DPLL_PIN_STATE_DISCONNECTED;
- pin->state[pf->dplls.pps.dpll_idx] =
- parent == pf->dplls.pps.dpll_idx ?
+ pps_state = parent == pf->dplls.pps.dpll_idx ?
DPLL_PIN_STATE_CONNECTED :
DPLL_PIN_STATE_DISCONNECTED;
- } else {
- pin->state[pf->dplls.eec.dpll_idx] =
- DPLL_PIN_STATE_DISCONNECTED;
- pin->state[pf->dplls.pps.dpll_idx] =
- DPLL_PIN_STATE_DISCONNECTED;
}
+ if (pf->dplls.eec.dpll_idx < ICE_DPLL_RCLK_NUM_MAX)
+ pin->state[pf->dplls.eec.dpll_idx] = eec_state;
+ if (pf->dplls.pps.dpll_idx < ICE_DPLL_RCLK_NUM_MAX)
+ pin->state[pf->dplls.pps.dpll_idx] = pps_state;
break;
case ICE_DPLL_PIN_TYPE_RCLK_INPUT:
if (pf->hw.mac_type == ICE_MAC_GENERIC_3K_E825) {
@@ -5180,6 +5179,13 @@ static int ice_dpll_init_info(struct ice_pf *pf, bool cgu)
de->dpll_idx = abilities.eec_dpll_idx;
dp->dpll_idx = abilities.pps_dpll_idx;
+ if (de->dpll_idx >= ICE_DPLL_RCLK_NUM_MAX ||
+ dp->dpll_idx >= ICE_DPLL_RCLK_NUM_MAX) {
+ dev_err(ice_pf_to_dev(pf),
+ "invalid dpll_idx in cgu abilities: eec=%u, pps=%u\n",
+ de->dpll_idx, dp->dpll_idx);
+ return -EINVAL;
+ }
d->num_inputs = abilities.num_inputs;
d->num_outputs = abilities.num_outputs;
d->input_phase_adj_max = le32_to_cpu(abilities.max_in_phase_adj) &
--
2.53.0
next prev parent reply other threads:[~2026-08-26 9:48 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-26 9:48 [PATCH iwl-next v4 0/6] Rework dpll pin control Sergey Temerkhanov
2026-08-26 9:48 ` [PATCH iwl-next v4 1/6] ice: dpll: Add the MUX tables to the documentation Sergey Temerkhanov
2026-08-26 9:48 ` [PATCH iwl-next v4 2/6] ice: dpll: Rework multiplexed pin notifications Sergey Temerkhanov
2026-08-26 9:48 ` [PATCH iwl-next v4 3/6] ice: dpll: Use switch statements to handle pin states Sergey Temerkhanov
2026-08-26 9:48 ` Sergey Temerkhanov [this message]
2026-08-26 9:48 ` [PATCH iwl-next v4 5/6] ice: dpll: Rework U.FL muxed pin (SMA) control Sergey Temerkhanov
2026-08-26 9:48 ` [PATCH iwl-next v4 6/6] ice: dpll: Rework the SMA control logic to match the requirements Sergey Temerkhanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260826094849.4112016-5-sergey.temerkhanov@intel.com \
--to=sergey.temerkhanov@intel.com \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox