drivers/net/pcs/pcs-rzn1-miic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
From: Kyle Hendry <khendry@reliablecontrols.com>
Fix memset parameters to initialize the entire DT value array
Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
---
drivers/net/pcs/pcs-rzn1-miic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
index 2b72fa98ddf1..ad4433971e50 100644
--- a/drivers/net/pcs/pcs-rzn1-miic.c
+++ b/drivers/net/pcs/pcs-rzn1-miic.c
@@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
if (!dt_val)
return -ENOMEM;
- memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
+ memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
if (of_property_read_u32(np, "renesas,miic-switch-portin", &conf) == 0)
dt_val[0] = conf;
---
base-commit: 9006c116dd111d457bf5d074990210f70a4ad2c8
change-id: 20260813-rzn1-miic-fix-array-e6ae4452c017
Best regards,
--
Kyle Hendry <khendry@reliablecontrols.com>CC Prabhakar
On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
<devnull+khendry.reliablecontrols.com@kernel.org> wrote:
> From: Kyle Hendry <khendry@reliablecontrols.com>
>
> Fix memset parameters to initialize the entire DT value array
>
> Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
to SoC-specific struct")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
> --- a/drivers/net/pcs/pcs-rzn1-miic.c
> +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
> if (!dt_val)
> return -ENOMEM;
>
> - memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> + memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
>
> if (of_property_read_u32(np, "renesas,miic-switch-portin", &conf) == 0)
> dt_val[0] = conf;
>
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Fri, Aug 14, 2026 at 10:11:28AM +0200, Geert Uytterhoeven wrote:
> CC Prabhakar
>
> On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
> <devnull+khendry.reliablecontrols.com@kernel.org> wrote:
> > From: Kyle Hendry <khendry@reliablecontrols.com>
> >
> > Fix memset parameters to initialize the entire DT value array
> >
> > Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
>
> Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
> to SoC-specific struct")
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
>
> > --- a/drivers/net/pcs/pcs-rzn1-miic.c
> > +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> > @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
> > if (!dt_val)
> > return -ENOMEM;
> >
> > - memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> > + memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
Sorry for hijacking your reply, i already deleted the original email.
This is correct, but could maybe be better. dt_val is allocated with.
kmalloc_objs(*dt_val, miic->of_data->conf_conv_count)
This allocates objects. It just happens your objects are s8, so size
of 1. But the memset() would be "more correct" with:
memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val) * miic->of_data->conf_conv_count);
And i checked, there is no memset_objs().
Andrew
Hi Andrew,
On Fri, 14 Aug 2026 at 15:14, Andrew Lunn <andrew@lunn.ch> wrote:
> On Fri, Aug 14, 2026 at 10:11:28AM +0200, Geert Uytterhoeven wrote:
> > On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
> > <devnull+khendry.reliablecontrols.com@kernel.org> wrote:
> > > From: Kyle Hendry <khendry@reliablecontrols.com>
> > >
> > > Fix memset parameters to initialize the entire DT value array
> > >
> > > Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
> >
> > Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
> > to SoC-specific struct")
> > Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
> >
> > > --- a/drivers/net/pcs/pcs-rzn1-miic.c
> > > +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> > > @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
> > > if (!dt_val)
> > > return -ENOMEM;
> > >
> > > - memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> > > + memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
>
> Sorry for hijacking your reply, i already deleted the original email.
Np ;-)
> This is correct, but could maybe be better. dt_val is allocated with.
>
> kmalloc_objs(*dt_val, miic->of_data->conf_conv_count)
>
> This allocates objects. It just happens your objects are s8, so size
> of 1. But the memset() would be "more correct" with:
>
> memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val) * miic->of_data->conf_conv_count);
That would indeed be more correct.
Note that there is an opportunity for a buffer overflow below:
for_each_available_child_of_node(np, conv) {
if (of_property_read_u32(conv, "reg", &port))
continue;
[...]
/* Adjust for 0 based index */
dt_val[port + !miic->of_data->miic_port_start] = conf;
[...]
What if "port" is out-of-range?
Do we just rely on dtbs_check to catch this?
}
> And i checked, there is no memset_objs().
The *_objs() APIs are still rather new and limited.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Thu, Aug 13, 2026 at 11:05:43AM -0700, Kyle Hendry via B4 Relay wrote:
> From: Kyle Hendry <khendry@reliablecontrols.com>
>
> Fix memset parameters to initialize the entire DT value array
>
> Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
© 2016 - 2026 Red Hat, Inc.