Skip to content

Commit e353b08

Browse files
akodanevPaolo Abeni
authored andcommitted
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTP_INT_STS) specifications. However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index: lan743x_ptp_io_event_clock_get(..., u8 channel,...) { ... /* Update Local timestamp */ extts = &ptp->extts[channel]; extts->ts.tv_sec = sec; ... } To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743X_PTP_N_EXTTS to 8. Detected using the static analysis tool - Svace. Fixes: 60942c3 ("net: lan743x: Add support for PTP-IO Event Input External Timestamp (extts)") Signed-off-by: Alexey Kodanev <[email protected]> Reviewed-by: Jacob Keller <[email protected]> Acked-by: Rengarajan S <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
1 parent 5bd1baf commit e353b08

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/net/ethernet/microchip/lan743x_ptp.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@
1818
*/
1919
#define LAN743X_PTP_N_EVENT_CHAN 2
2020
#define LAN743X_PTP_N_PEROUT LAN743X_PTP_N_EVENT_CHAN
21-
#define LAN743X_PTP_N_EXTTS 4
22-
#define LAN743X_PTP_N_PPS 0
2321
#define PCI11X1X_PTP_IO_MAX_CHANNELS 8
22+
#define LAN743X_PTP_N_EXTTS PCI11X1X_PTP_IO_MAX_CHANNELS
23+
#define LAN743X_PTP_N_PPS 0
2424
#define PTP_CMD_CTL_TIMEOUT_CNT 50
2525

2626
struct lan743x_adapter;

0 commit comments

Comments
 (0)