From 7b4ea2d888b434c6c07e124a0615da0468624971 Mon Sep 17 00:00:00 2001 From: Michal Simek Date: Wed, 19 Dec 2018 16:57:38 +0100 Subject: phy: Fix u-boot coruption when fixed-phy is used When fixed-link phy is used subnode offset is used as phy address. This number is bigger then space allocated for bus structure (allocated via mdio_alloc). bus->phymap[] array has PHY_MAX_ADDR size (32). That's why writing bus->phymap[addr] where addr is < 0 or > PHY_MAX_ADDR is causing write to memory which can caused full U-Boot crash. The patch is checking if address is in correct range. Signed-off-by: Michal Simek --- drivers/net/phy/phy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c index e837eb7688..cda4caa803 100644 --- a/drivers/net/phy/phy.c +++ b/drivers/net/phy/phy.c @@ -656,7 +656,8 @@ static struct phy_device *phy_device_create(struct mii_dev *bus, int addr, phy_probe(dev); - bus->phymap[addr] = dev; + if (addr >= 0 && addr < PHY_MAX_ADDR) + bus->phymap[addr] = dev; return dev; } -- cgit