Re: [PATCH 0/2] phy: ocelot-serdes: fix out-of-bounds bug

From: Gustavo A. R. Silva
Date: Tue Oct 09 2018 - 10:14:22 EST




On 10/9/18 9:28 AM, Quentin Schulz wrote:
> Hi Gustavo,
>
> On Tue, Oct 09, 2018 at 12:20:28AM +0200, Gustavo A. R. Silva wrote:
>> This patchset aims to fix an out-of-bounds bug in
>> the phy-ocelot-serdes driver.
>>
>> Currently, there is an out-of-bounds read on array ctrl->phys,
>> once variable i reaches the maximum array size of SERDES_MAX
>> in the for loop.
>>
>> Quentin Schulz pointed out that SERDES_MAX is a valid value to
>> index ctrl->phys. So, I updated SERDES_MAX to be SERDES6G_MAX + 1
>> in include/dt-bindings/phy/phy-ocelot-serdes.h.
>>
>> Then I changed the condition in the for loop from
>> i <= SERDES_MAX to i < SERDES_MAX in order to
>> complete the fix.
>>
>> The reason I'm sending this fix as series is because
>> checkpatch reported an error when I first tried to
>> integrate the whole solution into a singe patch. So,
>> changes to dt-bindings should be sent as a separate
>> patch.
>>
>
> Much appreciated, thank you!
>

Glad to help. :)

Thanks
--
Gustavo