xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound

Browse Source 
[ Upstream commit 61217be886b5f7402843677e4be7e7e83de9cb41 ]

In line 5001, if all id in the array 'lp->phy[8]' is not 0, when the
'for' end, the 'k' is 8.

At this time, the array 'lp->phy[8]' may be out of bound.

Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
zhangyue
2021-11-18 13:46:32 +08:00
committed by Greg Kroah-Hartman
parent 4d5968ea06
commit f059fa40f0
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/ethernet/dec/tulip/de4x5.c
View File

@@ -4997,6 +4997,7 @@ mii_get_phy(struct net_device *dev)
} }
if ((j == limit) && (i < DE4X5_MAX_MII)) { if ((j == limit) && (i < DE4X5_MAX_MII)) {
for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++); for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
if (k < DE4X5_MAX_PHY) {
lp->phy[k].addr = i; lp->phy[k].addr = i;
lp->phy[k].id = id; lp->phy[k].id = id;
lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */ lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */
@@ -5010,6 +5011,9 @@ mii_get_phy(struct net_device *dev)
de4x5_dbg_mii(dev, k); de4x5_dbg_mii(dev, k);
de4x5_debug = j; de4x5_debug = j;
printk("\n"); printk("\n");
} else {
goto purgatory;
}
} }
} }
purgatory: purgatory: