[PATCH] net: pcs: rzn1-miic: Fix config array initialization

[PATCH] net: pcs: rzn1-miic: Fix config array initialization

[Kyle Hendry via B4 Relay]

From: Kyle Hendry <khendry@reliablecontrols.com>

Fix memset parameters to initialize the entire DT value array

Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
---
 drivers/net/pcs/pcs-rzn1-miic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
index 2b72fa98ddf1..ad4433971e50 100644
--- a/drivers/net/pcs/pcs-rzn1-miic.c
+++ b/drivers/net/pcs/pcs-rzn1-miic.c
@@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
 	if (!dt_val)
 		return -ENOMEM;
 
-	memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
+	memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
 
 	if (of_property_read_u32(np, "renesas,miic-switch-portin", &conf) == 0)
 		dt_val[0] = conf;

---
base-commit: 9006c116dd111d457bf5d074990210f70a4ad2c8
change-id: 20260813-rzn1-miic-fix-array-e6ae4452c017

Best regards,
-- 
Kyle Hendry <khendry@reliablecontrols.com>

Re: [PATCH] net: pcs: rzn1-miic: Fix config array initialization

[Andrew Lunn]

On Thu, Aug 13, 2026 at 11:05:43AM -0700, Kyle Hendry via B4 Relay wrote:
> From: Kyle Hendry <khendry@reliablecontrols.com>
> 
> Fix memset parameters to initialize the entire DT value array
> 
> Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH] net: pcs: rzn1-miic: Fix config array initialization

[Geert Uytterhoeven]

CC Prabhakar

On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
<devnull+khendry.reliablecontrols.com@kernel.org> wrote:
> From: Kyle Hendry <khendry@reliablecontrols.com>
>
> Fix memset parameters to initialize the entire DT value array
>
> Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>

Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
to SoC-specific struct")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

> --- a/drivers/net/pcs/pcs-rzn1-miic.c
> +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
>         if (!dt_val)
>                 return -ENOMEM;
>
> -       memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> +       memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
>
>         if (of_property_read_u32(np, "renesas,miic-switch-portin", &conf) == 0)
>                 dt_val[0] = conf;
>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH] net: pcs: rzn1-miic: Fix config array initialization

[Andrew Lunn]

On Fri, Aug 14, 2026 at 10:11:28AM +0200, Geert Uytterhoeven wrote:
> CC Prabhakar
> 
> On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
> <devnull+khendry.reliablecontrols.com@kernel.org> wrote:
> > From: Kyle Hendry <khendry@reliablecontrols.com>
> >
> > Fix memset parameters to initialize the entire DT value array
> >
> > Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
> 
> Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
> to SoC-specific struct")
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
> 
> > --- a/drivers/net/pcs/pcs-rzn1-miic.c
> > +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> > @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
> >         if (!dt_val)
> >                 return -ENOMEM;
> >
> > -       memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> > +       memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);

Sorry for hijacking your reply, i already deleted the original email.

This is correct, but could maybe be better. dt_val is allocated with.

     kmalloc_objs(*dt_val, miic->of_data->conf_conv_count)

This allocates objects. It just happens your objects are s8, so size
of 1. But the memset() would be "more correct" with:

memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val) * miic->of_data->conf_conv_count);

And i checked, there is no memset_objs().

       Andrew

Re: [PATCH] net: pcs: rzn1-miic: Fix config array initialization

[Geert Uytterhoeven]

Hi Andrew,

On Fri, 14 Aug 2026 at 15:14, Andrew Lunn <andrew@lunn.ch> wrote:
> On Fri, Aug 14, 2026 at 10:11:28AM +0200, Geert Uytterhoeven wrote:
> > On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
> > <devnull+khendry.reliablecontrols.com@kernel.org> wrote:
> > > From: Kyle Hendry <khendry@reliablecontrols.com>
> > >
> > > Fix memset parameters to initialize the entire DT value array
> > >
> > > Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
> >
> > Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
> > to SoC-specific struct")
> > Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
> >
> > > --- a/drivers/net/pcs/pcs-rzn1-miic.c
> > > +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> > > @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
> > >         if (!dt_val)
> > >                 return -ENOMEM;
> > >
> > > -       memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> > > +       memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
>
> Sorry for hijacking your reply, i already deleted the original email.

Np ;-)

> This is correct, but could maybe be better. dt_val is allocated with.
>
>      kmalloc_objs(*dt_val, miic->of_data->conf_conv_count)
>
> This allocates objects. It just happens your objects are s8, so size
> of 1. But the memset() would be "more correct" with:
>
> memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val) * miic->of_data->conf_conv_count);

That would indeed be more correct.

Note that there is an opportunity for a buffer overflow below:

        for_each_available_child_of_node(np, conv) {
                if (of_property_read_u32(conv, "reg", &port))
                        continue;

                [...]

                /* Adjust for 0 based index */
                dt_val[port + !miic->of_data->miic_port_start] = conf;

                [...]

What if "port" is out-of-range?
Do we just rely on dtbs_check to catch this?

        }

> And i checked, there is no memset_objs().

The *_objs() APIs are still rather new and limited.

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds