Re: [PATCH] net: pcs: rzn1-miic: Fix config array initialization

[Geert Uytterhoeven]

Hi Andrew,

On Fri, 14 Aug 2026 at 15:14, Andrew Lunn <andrew@xxxxxxx> wrote:
> On Fri, Aug 14, 2026 at 10:11:28AM +0200, Geert Uytterhoeven wrote:
> > On Thu, 13 Aug 2026 at 20:09, Kyle Hendry via B4 Relay
> > <devnull+khendry.reliablecontrols.com@xxxxxxxxxx> wrote:
> > > From: Kyle Hendry <khendry@xxxxxxxxxxxxxxxxxxxx>
> > >
> > > Fix memset parameters to initialize the entire DT value array
> > >
> > > Signed-off-by: Kyle Hendry <khendry@xxxxxxxxxxxxxxxxxxxx>
> >
> > Fixes: f39e968dc168a7bd ("net: pcs: rzn1-miic: Move configuration data
> > to SoC-specific struct")
> > Reviewed-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
> >
> > > --- a/drivers/net/pcs/pcs-rzn1-miic.c
> > > +++ b/drivers/net/pcs/pcs-rzn1-miic.c
> > > @@ -683,7 +683,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
> > >         if (!dt_val)
> > >                 return -ENOMEM;
> > >
> > > -       memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val));
> > > +       memset(dt_val, MIIC_MODCTRL_CONF_NONE, miic->of_data->conf_conv_count);
>
> Sorry for hijacking your reply, i already deleted the original email.

Np ;-)

> This is correct, but could maybe be better. dt_val is allocated with.
>
>      kmalloc_objs(*dt_val, miic->of_data->conf_conv_count)
>
> This allocates objects. It just happens your objects are s8, so size
> of 1. But the memset() would be "more correct" with:
>
> memset(dt_val, MIIC_MODCTRL_CONF_NONE, sizeof(*dt_val) * miic->of_data->conf_conv_count);

That would indeed be more correct.

Note that there is an opportunity for a buffer overflow below:

        for_each_available_child_of_node(np, conv) {
                if (of_property_read_u32(conv, "reg", &port))
                        continue;

                [...]

                /* Adjust for 0 based index */
                dt_val[port + !miic->of_data->miic_port_start] = conf;

                [...]

What if "port" is out-of-range?
Do we just rely on dtbs_check to catch this?

        }

> And i checked, there is no memset_objs().

The *_objs() APIs are still rather new and limited.

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds