* [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug
@ 2018-10-08 22:20 Gustavo A. R. Silva
2018-10-08 22:21 ` [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1 Gustavo A. R. Silva
` (2 more replies)
0 siblings, 3 replies; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-08 22:20 UTC (permalink / raw)
To: Rob Herring, Mark Rutland, Kishon Vijay Abraham I, David S. Miller
Cc: linux-kernel, Quentin Schulz, Gustavo A. R. Silva
This patchset aims to fix an out-of-bounds bug in
the phy-ocelot-serdes driver.
Currently, there is an out-of-bounds read on array ctrl->phys,
once variable i reaches the maximum array size of SERDES_MAX
in the for loop.
Quentin Schulz pointed out that SERDES_MAX is a valid value to
index ctrl->phys. So, I updated SERDES_MAX to be SERDES6G_MAX + 1
in include/dt-bindings/phy/phy-ocelot-serdes.h.
Then I changed the condition in the for loop from
i <= SERDES_MAX to i < SERDES_MAX in order to
complete the fix.
The reason I'm sending this fix as series is because
checkpatch reported an error when I first tried to
integrate the whole solution into a singe patch. So,
changes to dt-bindings should be sent as a separate
patch.
Thanks
Gustavo A. R. Silva (2):
dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
phy: ocelot-serdes: fix out-of-bounds read
drivers/phy/mscc/phy-ocelot-serdes.c | 4 ++--
include/dt-bindings/phy/phy-ocelot-serdes.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--
2.7.4
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-08 22:20 [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Gustavo A. R. Silva
@ 2018-10-08 22:21 ` Gustavo A. R. Silva
2018-10-09 7:27 ` Quentin Schulz
2018-10-08 22:22 ` [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read Gustavo A. R. Silva
2018-10-09 7:28 ` [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Quentin Schulz
2 siblings, 1 reply; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-08 22:21 UTC (permalink / raw)
To: Rob Herring, Mark Rutland
Cc: linux-kernel, Quentin Schulz, Gustavo A. R. Silva, devicetree
SERDES_MAX is a valid value to index ctrl->phys in
drivers/phy/mscc/phy-ocelot-serdes.c. But, currently,
there is an out-of-bounds bug in the mentioned driver
when reading from ctrl->phys, because the size of
array ctrl->phys is SERDES_MAX.
Partially fix this by updating SERDES_MAX to be SERDES6G_MAX + 1.
Notice that this is the first part of the solution to
the out-of-bounds bug mentioned above. Although this
change is not dependent on any other one.
Suggested-by: Quentin Schulz <quentin.schulz@bootlin.com>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
include/dt-bindings/phy/phy-ocelot-serdes.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/dt-bindings/phy/phy-ocelot-serdes.h b/include/dt-bindings/phy/phy-ocelot-serdes.h
index bd28f21..fe70ada 100644
--- a/include/dt-bindings/phy/phy-ocelot-serdes.h
+++ b/include/dt-bindings/phy/phy-ocelot-serdes.h
@@ -7,6 +7,6 @@
#define SERDES1G_MAX SERDES1G(5)
#define SERDES6G(x) (SERDES1G_MAX + 1 + (x))
#define SERDES6G_MAX SERDES6G(2)
-#define SERDES_MAX SERDES6G_MAX
+#define SERDES_MAX (SERDES6G_MAX + 1)
#endif
--
2.7.4
^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-08 22:21 ` [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1 Gustavo A. R. Silva
@ 2018-10-09 7:27 ` Quentin Schulz
2018-10-16 8:44 ` Gustavo A. R. Silva
0 siblings, 1 reply; 16+ messages in thread
From: Quentin Schulz @ 2018-10-09 7:27 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Rob Herring, Mark Rutland, linux-kernel, devicetree
[-- Attachment #1: Type: text/plain, Size: 660 bytes --]
Hi Gustavo,
On Tue, Oct 09, 2018 at 12:21:36AM +0200, Gustavo A. R. Silva wrote:
> SERDES_MAX is a valid value to index ctrl->phys in
> drivers/phy/mscc/phy-ocelot-serdes.c. But, currently,
> there is an out-of-bounds bug in the mentioned driver
> when reading from ctrl->phys, because the size of
> array ctrl->phys is SERDES_MAX.
>
> Partially fix this by updating SERDES_MAX to be SERDES6G_MAX + 1.
>
> Notice that this is the first part of the solution to
> the out-of-bounds bug mentioned above. Although this
> change is not dependent on any other one.
>
Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
Thanks,
Quentin
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-09 7:27 ` Quentin Schulz
@ 2018-10-16 8:44 ` Gustavo A. R. Silva
2018-10-17 15:09 ` Rob Herring
0 siblings, 1 reply; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-16 8:44 UTC (permalink / raw)
To: Quentin Schulz; +Cc: Rob Herring, Mark Rutland, linux-kernel, devicetree
Hi,
On 10/9/18 9:27 AM, Quentin Schulz wrote:
> Hi Gustavo,
>
> On Tue, Oct 09, 2018 at 12:21:36AM +0200, Gustavo A. R. Silva wrote:
>> SERDES_MAX is a valid value to index ctrl->phys in
>> drivers/phy/mscc/phy-ocelot-serdes.c. But, currently,
>> there is an out-of-bounds bug in the mentioned driver
>> when reading from ctrl->phys, because the size of
>> array ctrl->phys is SERDES_MAX.
>>
>> Partially fix this by updating SERDES_MAX to be SERDES6G_MAX + 1.
>>
>> Notice that this is the first part of the solution to
>> the out-of-bounds bug mentioned above. Although this
>> change is not dependent on any other one.
>>
>
> Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
>
Friendly ping. Who can you take this?
Thanks!
--
Gustavo
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-16 8:44 ` Gustavo A. R. Silva
@ 2018-10-17 15:09 ` Rob Herring
2018-10-17 15:19 ` Gustavo A. R. Silva
2018-10-17 15:23 ` Rob Herring
0 siblings, 2 replies; 16+ messages in thread
From: Rob Herring @ 2018-10-17 15:09 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Quentin Schulz, Mark Rutland, linux-kernel, devicetree
On Tue, Oct 16, 2018 at 10:44:52AM +0200, Gustavo A. R. Silva wrote:
> Hi,
>
> On 10/9/18 9:27 AM, Quentin Schulz wrote:
> > Hi Gustavo,
> >
> > On Tue, Oct 09, 2018 at 12:21:36AM +0200, Gustavo A. R. Silva wrote:
> >> SERDES_MAX is a valid value to index ctrl->phys in
> >> drivers/phy/mscc/phy-ocelot-serdes.c. But, currently,
> >> there is an out-of-bounds bug in the mentioned driver
> >> when reading from ctrl->phys, because the size of
> >> array ctrl->phys is SERDES_MAX.
> >>
> >> Partially fix this by updating SERDES_MAX to be SERDES6G_MAX + 1.
> >>
> >> Notice that this is the first part of the solution to
> >> the out-of-bounds bug mentioned above. Although this
> >> change is not dependent on any other one.
> >>
> >
> > Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
> >
>
> Friendly ping. Who can you take this?
Applied. No need (nor benefit) to ping me. You can check the status of
DT patches on patchwork[1]. If it is there and in the "New" state, it is
in my queue.
Rob
[1] https://patchwork.ozlabs.org/project/devicetree-bindings/list/
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-17 15:09 ` Rob Herring
@ 2018-10-17 15:19 ` Gustavo A. R. Silva
2018-10-17 15:23 ` Rob Herring
1 sibling, 0 replies; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-17 15:19 UTC (permalink / raw)
To: Rob Herring; +Cc: Quentin Schulz, Mark Rutland, linux-kernel, devicetree
On 10/17/18 5:09 PM, Rob Herring wrote:
>>
>> Friendly ping. Who can you take this?
>
> Applied. No need (nor benefit) to ping me. You can check the status of
> DT patches on patchwork[1]. If it is there and in the "New" state, it is
> in my queue.
>
OK. I've got it. I just didn't know who usually takes these dt-bindings patches.
> Rob
>
> [1] https://patchwork.ozlabs.org/project/devicetree-bindings/list/
>
Thanks, Rob.
--
Gustavo
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-17 15:09 ` Rob Herring
2018-10-17 15:19 ` Gustavo A. R. Silva
@ 2018-10-17 15:23 ` Rob Herring
2018-10-17 15:45 ` Gustavo A. R. Silva
1 sibling, 1 reply; 16+ messages in thread
From: Rob Herring @ 2018-10-17 15:23 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Quentin Schulz, Mark Rutland, linux-kernel, devicetree
On Wed, Oct 17, 2018 at 10:09:31AM -0500, Rob Herring wrote:
> On Tue, Oct 16, 2018 at 10:44:52AM +0200, Gustavo A. R. Silva wrote:
> > Hi,
> >
> > On 10/9/18 9:27 AM, Quentin Schulz wrote:
> > > Hi Gustavo,
> > >
> > > On Tue, Oct 09, 2018 at 12:21:36AM +0200, Gustavo A. R. Silva wrote:
> > >> SERDES_MAX is a valid value to index ctrl->phys in
> > >> drivers/phy/mscc/phy-ocelot-serdes.c. But, currently,
> > >> there is an out-of-bounds bug in the mentioned driver
> > >> when reading from ctrl->phys, because the size of
> > >> array ctrl->phys is SERDES_MAX.
> > >>
> > >> Partially fix this by updating SERDES_MAX to be SERDES6G_MAX + 1.
> > >>
> > >> Notice that this is the first part of the solution to
> > >> the out-of-bounds bug mentioned above. Although this
> > >> change is not dependent on any other one.
> > >>
> > >
> > > Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
> > >
> >
> > Friendly ping. Who can you take this?
>
> Applied. No need (nor benefit) to ping me. You can check the status of
> DT patches on patchwork[1]. If it is there and in the "New" state, it is
> in my queue.
Actually, this doesn't apply to my tree as the file doesn't exist. It
needs to go thru the phy tree. You didn't Cc the maintainer nor list, so
resend.
Acked-by: Rob Herring <robh@kernel.org>
Rob
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1
2018-10-17 15:23 ` Rob Herring
@ 2018-10-17 15:45 ` Gustavo A. R. Silva
0 siblings, 0 replies; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-17 15:45 UTC (permalink / raw)
To: Rob Herring; +Cc: Quentin Schulz, Mark Rutland, linux-kernel, devicetree
On 10/17/18 5:23 PM, Rob Herring wrote:
>>> Friendly ping. Who can you take this?
>>
>> Applied. No need (nor benefit) to ping me. You can check the status of
>> DT patches on patchwork[1]. If it is there and in the "New" state, it is
>> in my queue.
>
> Actually, this doesn't apply to my tree as the file doesn't exist. It
> needs to go thru the phy tree. You didn't Cc the maintainer nor list, so
> resend.
>
This is what I get when I run the get_maintainer script:
linux$ scripts/get_maintainer.pl --nokeywords --nogit --nogit-fallback include/dt-bindings/phy/phy-ocelot-serdes.h
Rob Herring <robh+dt@kernel.org> (maintainer:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS)
Mark Rutland <mark.rutland@arm.com> (maintainer:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS)
devicetree@vger.kernel.org (open list:OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS)
linux-kernel@vger.kernel.org (open list)
But I'll send it to the phy guys as you suggest.
> Acked-by: Rob Herring <robh@kernel.org>
>
Thanks
--
Gustavo
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read
2018-10-08 22:20 [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Gustavo A. R. Silva
2018-10-08 22:21 ` [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1 Gustavo A. R. Silva
@ 2018-10-08 22:22 ` Gustavo A. R. Silva
2018-10-09 7:28 ` Quentin Schulz
2018-10-09 7:28 ` [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Quentin Schulz
2 siblings, 1 reply; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-08 22:22 UTC (permalink / raw)
To: Kishon Vijay Abraham I, David S. Miller
Cc: linux-kernel, Quentin Schulz, Gustavo A. R. Silva
Currently, there is an out-of-bounds read on array ctrl->phys,
once variable i reaches the maximum array size of SERDES_MAX
in the for loop.
Fix this by changing the condition in the for loop from
i <= SERDES_MAX to i < SERDES_MAX.
Addresses-Coverity-ID: 1473966 ("Out-of-bounds read")
Addresses-Coverity-ID: 1473959 ("Out-of-bounds read")
Fixes: 51f6b410fc22 ("phy: add driver for Microsemi Ocelot SerDes muxing")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
drivers/phy/mscc/phy-ocelot-serdes.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/mscc/phy-ocelot-serdes.c b/drivers/phy/mscc/phy-ocelot-serdes.c
index 8936abd..c4eee3a 100644
--- a/drivers/phy/mscc/phy-ocelot-serdes.c
+++ b/drivers/phy/mscc/phy-ocelot-serdes.c
@@ -206,7 +206,7 @@ static struct phy *serdes_simple_xlate(struct device *dev,
port = args->args[0];
idx = args->args[1];
- for (i = 0; i <= SERDES_MAX; i++) {
+ for (i = 0; i < SERDES_MAX; i++) {
struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]);
if (idx != macro->idx)
@@ -260,7 +260,7 @@ static int serdes_probe(struct platform_device *pdev)
if (!ctrl->regs)
return -ENODEV;
- for (i = 0; i <= SERDES_MAX; i++) {
+ for (i = 0; i < SERDES_MAX; i++) {
ret = serdes_phy_create(ctrl, i, &ctrl->phys[i]);
if (ret)
return ret;
--
2.7.4
^ permalink raw reply related [flat|nested] 16+ messages in thread* Re: [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read
2018-10-08 22:22 ` [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read Gustavo A. R. Silva
@ 2018-10-09 7:28 ` Quentin Schulz
2018-10-16 8:46 ` Gustavo A. R. Silva
0 siblings, 1 reply; 16+ messages in thread
From: Quentin Schulz @ 2018-10-09 7:28 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Kishon Vijay Abraham I, David S. Miller, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 420 bytes --]
Hi Gustavo,
On Tue, Oct 09, 2018 at 12:22:33AM +0200, Gustavo A. R. Silva wrote:
> Currently, there is an out-of-bounds read on array ctrl->phys,
> once variable i reaches the maximum array size of SERDES_MAX
> in the for loop.
>
> Fix this by changing the condition in the for loop from
> i <= SERDES_MAX to i < SERDES_MAX.
>
Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
Thanks,
Quentin
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read
2018-10-09 7:28 ` Quentin Schulz
@ 2018-10-16 8:46 ` Gustavo A. R. Silva
2018-10-16 8:48 ` Kishon Vijay Abraham I
0 siblings, 1 reply; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-16 8:46 UTC (permalink / raw)
To: Quentin Schulz; +Cc: Kishon Vijay Abraham I, David S. Miller, linux-kernel
Hi,
On 10/9/18 9:28 AM, Quentin Schulz wrote:
> Hi Gustavo,
>
> On Tue, Oct 09, 2018 at 12:22:33AM +0200, Gustavo A. R. Silva wrote:
>> Currently, there is an out-of-bounds read on array ctrl->phys,
>> once variable i reaches the maximum array size of SERDES_MAX
>> in the for loop.
>>
>> Fix this by changing the condition in the for loop from
>> i <= SERDES_MAX to i < SERDES_MAX.
>>
>
> Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
>
Friendly ping. Who can you take this?
Thanks!
--
Gustavo
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read
2018-10-16 8:46 ` Gustavo A. R. Silva
@ 2018-10-16 8:48 ` Kishon Vijay Abraham I
2018-10-17 15:37 ` Gustavo A. R. Silva
0 siblings, 1 reply; 16+ messages in thread
From: Kishon Vijay Abraham I @ 2018-10-16 8:48 UTC (permalink / raw)
To: Gustavo A. R. Silva, Quentin Schulz; +Cc: David S. Miller, linux-kernel
Hi,
On Tuesday 16 October 2018 02:16 PM, Gustavo A. R. Silva wrote:
> Hi,
>
> On 10/9/18 9:28 AM, Quentin Schulz wrote:
>> Hi Gustavo,
>>
>> On Tue, Oct 09, 2018 at 12:22:33AM +0200, Gustavo A. R. Silva wrote:
>>> Currently, there is an out-of-bounds read on array ctrl->phys,
>>> once variable i reaches the maximum array size of SERDES_MAX
>>> in the for loop.
>>>
>>> Fix this by changing the condition in the for loop from
>>> i <= SERDES_MAX to i < SERDES_MAX.
>>>
>>
>> Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
>>
>
> Friendly ping. Who can you take this?
This can go during the 4.20 -rc cycle.
Thanks
Kishon
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read
2018-10-16 8:48 ` Kishon Vijay Abraham I
@ 2018-10-17 15:37 ` Gustavo A. R. Silva
2018-11-12 8:27 ` Kishon Vijay Abraham I
0 siblings, 1 reply; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-17 15:37 UTC (permalink / raw)
To: Kishon Vijay Abraham I, Quentin Schulz; +Cc: David S. Miller, linux-kernel
Hi Kishon,
On 10/16/18 10:48 AM, Kishon Vijay Abraham I wrote:
> Hi,
>
> On Tuesday 16 October 2018 02:16 PM, Gustavo A. R. Silva wrote:
>> Hi,
>>
>> On 10/9/18 9:28 AM, Quentin Schulz wrote:
>>> Hi Gustavo,
>>>
>>> On Tue, Oct 09, 2018 at 12:22:33AM +0200, Gustavo A. R. Silva wrote:
>>>> Currently, there is an out-of-bounds read on array ctrl->phys,
>>>> once variable i reaches the maximum array size of SERDES_MAX
>>>> in the for loop.
>>>>
>>>> Fix this by changing the condition in the for loop from
>>>> i <= SERDES_MAX to i < SERDES_MAX.
>>>>
>>>
>>> Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
>>>
>>
>> Friendly ping. Who can you take this?
>
> This can go during the 4.20 -rc cycle.
>
Should I resend the following patch to you, so the whole series is
applied to your phy tree?
https://lore.kernel.org/patchwork/patch/997326/
Thanks
--
Gustavo
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read
2018-10-17 15:37 ` Gustavo A. R. Silva
@ 2018-11-12 8:27 ` Kishon Vijay Abraham I
0 siblings, 0 replies; 16+ messages in thread
From: Kishon Vijay Abraham I @ 2018-11-12 8:27 UTC (permalink / raw)
To: Gustavo A. R. Silva, Quentin Schulz; +Cc: David S. Miller, linux-kernel
Hi,
On 17/10/18 9:07 PM, Gustavo A. R. Silva wrote:
> Hi Kishon,
>
> On 10/16/18 10:48 AM, Kishon Vijay Abraham I wrote:
>> Hi,
>>
>> On Tuesday 16 October 2018 02:16 PM, Gustavo A. R. Silva wrote:
>>> Hi,
>>>
>>> On 10/9/18 9:28 AM, Quentin Schulz wrote:
>>>> Hi Gustavo,
>>>>
>>>> On Tue, Oct 09, 2018 at 12:22:33AM +0200, Gustavo A. R. Silva wrote:
>>>>> Currently, there is an out-of-bounds read on array ctrl->phys,
>>>>> once variable i reaches the maximum array size of SERDES_MAX
>>>>> in the for loop.
>>>>>
>>>>> Fix this by changing the condition in the for loop from
>>>>> i <= SERDES_MAX to i < SERDES_MAX.
>>>>>
>>>>
>>>> Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
>>>>
>>>
>>> Friendly ping. Who can you take this?
>>
>> This can go during the 4.20 -rc cycle.
>>
>
> Should I resend the following patch to you, so the whole series is
> applied to your phy tree?
>
> https://lore.kernel.org/patchwork/patch/997326/
This is merged by David Miller.
Thanks
Kishon
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug
2018-10-08 22:20 [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Gustavo A. R. Silva
2018-10-08 22:21 ` [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1 Gustavo A. R. Silva
2018-10-08 22:22 ` [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read Gustavo A. R. Silva
@ 2018-10-09 7:28 ` Quentin Schulz
2018-10-09 14:13 ` Gustavo A. R. Silva
2 siblings, 1 reply; 16+ messages in thread
From: Quentin Schulz @ 2018-10-09 7:28 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Rob Herring, Mark Rutland, Kishon Vijay Abraham I,
David S. Miller, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 924 bytes --]
Hi Gustavo,
On Tue, Oct 09, 2018 at 12:20:28AM +0200, Gustavo A. R. Silva wrote:
> This patchset aims to fix an out-of-bounds bug in
> the phy-ocelot-serdes driver.
>
> Currently, there is an out-of-bounds read on array ctrl->phys,
> once variable i reaches the maximum array size of SERDES_MAX
> in the for loop.
>
> Quentin Schulz pointed out that SERDES_MAX is a valid value to
> index ctrl->phys. So, I updated SERDES_MAX to be SERDES6G_MAX + 1
> in include/dt-bindings/phy/phy-ocelot-serdes.h.
>
> Then I changed the condition in the for loop from
> i <= SERDES_MAX to i < SERDES_MAX in order to
> complete the fix.
>
> The reason I'm sending this fix as series is because
> checkpatch reported an error when I first tried to
> integrate the whole solution into a singe patch. So,
> changes to dt-bindings should be sent as a separate
> patch.
>
Much appreciated, thank you!
Quentin
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug
2018-10-09 7:28 ` [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Quentin Schulz
@ 2018-10-09 14:13 ` Gustavo A. R. Silva
0 siblings, 0 replies; 16+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-09 14:13 UTC (permalink / raw)
To: Quentin Schulz
Cc: Rob Herring, Mark Rutland, Kishon Vijay Abraham I,
David S. Miller, linux-kernel
On 10/9/18 9:28 AM, Quentin Schulz wrote:
> Hi Gustavo,
>
> On Tue, Oct 09, 2018 at 12:20:28AM +0200, Gustavo A. R. Silva wrote:
>> This patchset aims to fix an out-of-bounds bug in
>> the phy-ocelot-serdes driver.
>>
>> Currently, there is an out-of-bounds read on array ctrl->phys,
>> once variable i reaches the maximum array size of SERDES_MAX
>> in the for loop.
>>
>> Quentin Schulz pointed out that SERDES_MAX is a valid value to
>> index ctrl->phys. So, I updated SERDES_MAX to be SERDES6G_MAX + 1
>> in include/dt-bindings/phy/phy-ocelot-serdes.h.
>>
>> Then I changed the condition in the for loop from
>> i <= SERDES_MAX to i < SERDES_MAX in order to
>> complete the fix.
>>
>> The reason I'm sending this fix as series is because
>> checkpatch reported an error when I first tried to
>> integrate the whole solution into a singe patch. So,
>> changes to dt-bindings should be sent as a separate
>> patch.
>>
>
> Much appreciated, thank you!
>
Glad to help. :)
Thanks
--
Gustavo
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2018-11-12 8:28 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-08 22:20 [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Gustavo A. R. Silva
2018-10-08 22:21 ` [PATCH 1/2] dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1 Gustavo A. R. Silva
2018-10-09 7:27 ` Quentin Schulz
2018-10-16 8:44 ` Gustavo A. R. Silva
2018-10-17 15:09 ` Rob Herring
2018-10-17 15:19 ` Gustavo A. R. Silva
2018-10-17 15:23 ` Rob Herring
2018-10-17 15:45 ` Gustavo A. R. Silva
2018-10-08 22:22 ` [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read Gustavo A. R. Silva
2018-10-09 7:28 ` Quentin Schulz
2018-10-16 8:46 ` Gustavo A. R. Silva
2018-10-16 8:48 ` Kishon Vijay Abraham I
2018-10-17 15:37 ` Gustavo A. R. Silva
2018-11-12 8:27 ` Kishon Vijay Abraham I
2018-10-09 7:28 ` [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug Quentin Schulz
2018-10-09 14:13 ` Gustavo A. R. Silva
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).