Re: [PATCH v3] net: phy: air_en8811h: add AN8811HB MCU assert/deassert support

[Andrew Lunn]

> > @@ -1175,10 +1281,22 @@ static int an8811hb_probe(struct phy_device *phydev)
> >  		return -ENOMEM;
> >  	phydev->priv = priv;
> >  
> > +	mdiodev = mdio_device_create(phydev->mdio.bus,
> > +				     phydev->mdio.addr + EN8811H_PBUS_ADDR_OFFS);
> 
> Sashiko says:
> 
> Can this create an out-of-bounds array access if the base PHY address is
> high?
> The mdio_map array in struct mii_bus has a fixed size of PHY_MAX_ADDR (32).
> If phydev->mdio.addr is 24 or higher, adding EN8811H_PBUS_ADDR_OFFS (8)
> will result in an address of 32 or more.
> Neither mdio_device_create() nor mdio_device_register() validate that
> the address is within PHY_MAX_ADDR. When mdiobus_register_device()
> executes mdiodev->bus->mdio_map[mdiodev->addr] = mdiodev, could this
> write past the end of the array and corrupt adjacent memory?

This has been discussed once, but Sashiko has a shorter memory than a
goldfish. It is guaranteed by hardware design that + 8 will work.

	  Andrew