[v1] net: phy: dp83869: fix memory corruption when enabling fiber

[PATCH net] net: phy: dp83869: fix memory corruption when enabling fiber

Posted by Ingo van Lil 1 month, 3 weeks ago

When configuring the fiber port, the DP83869 PHY driver incorrectly
calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit
number (10). This corrupts some other memory location -- in case of
arm64 the priv pointer in the same structure.

Since the advertising flags are updated from supported at the end of the
function the incorrect line isn't needed at all and can be removed.

Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection")
Signed-off-by: Ingo van Lil <inguin@gmx.de>
---
 drivers/net/phy/dp83869.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c
index d7aaefb5226b..5f056d7db83e 100644
--- a/drivers/net/phy/dp83869.c
+++ b/drivers/net/phy/dp83869.c
@@ -645,7 +645,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev,
 		     phydev->supported);

 	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
-	linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising);

 	if (dp83869->mode == DP83869_RGMII_1000_BASE) {
 		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
--
2.46.2

Re: [PATCH net] net: phy: dp83869: fix memory corruption when enabling fiber

Posted by Jakub Kicinski 1 month, 3 weeks ago

On Wed,  2 Oct 2024 18:18:07 +0200 Ingo van Lil wrote:
> When configuring the fiber port, the DP83869 PHY driver incorrectly
> calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit
> number (10). This corrupts some other memory location -- in case of
> arm64 the priv pointer in the same structure.
> 
> Since the advertising flags are updated from supported at the end of the
> function the incorrect line isn't needed at all and can be removed.
> 
> Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection")
> Signed-off-by: Ingo van Lil <inguin@gmx.de>

Applied, thanks!
-- 
pw-bot: accept

Re: [PATCH net] net: phy: dp83869: fix memory corruption when enabling fiber

Posted by Andrew Lunn 1 month, 3 weeks ago

On Wed, Oct 02, 2024 at 06:18:07PM +0200, Ingo van Lil wrote:
> When configuring the fiber port, the DP83869 PHY driver incorrectly
> calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit
> number (10). This corrupts some other memory location -- in case of
> arm64 the priv pointer in the same structure.
> 
> Since the advertising flags are updated from supported at the end of the
> function the incorrect line isn't needed at all and can be removed.
> 
> Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection")
> Signed-off-by: Ingo van Lil <inguin@gmx.de>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH net] net: phy: dp83869: fix memory corruption when enabling fiber

Posted by Sverdlin, Alexander 1 month, 3 weeks ago

On Wed, 2024-10-02 at 18:18 +0200, Ingo van Lil wrote:
> When configuring the fiber port, the DP83869 PHY driver incorrectly
> calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit
> number (10). This corrupts some other memory location -- in case of
> arm64 the priv pointer in the same structure.
> 
> Since the advertising flags are updated from supported at the end of the
> function the incorrect line isn't needed at all and can be removed.
> 
> Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection")
> Signed-off-by: Ingo van Lil <inguin@gmx.de>

You've probably forgot "v2" in the [PATCH], nevertheless,

Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>

> ---
>  drivers/net/phy/dp83869.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c
> index d7aaefb5226b..5f056d7db83e 100644
> --- a/drivers/net/phy/dp83869.c
> +++ b/drivers/net/phy/dp83869.c
> @@ -645,7 +645,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev,
>  		     phydev->supported);
> 
>  	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
> -	linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising);
> 
>  	if (dp83869->mode == DP83869_RGMII_1000_BASE) {
>  		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,

-- 
Alexander Sverdlin
Siemens AG
www.siemens.com