diff options
| author | Michal Simek <michal.simek@xilinx.com> | 2018-12-19 16:57:38 +0100 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2018-12-26 21:35:52 -0500 |
| commit | 7b4ea2d888b434c6c07e124a0615da0468624971 (patch) | |
| tree | fe44b9b22a7367588ae7dba6d7bf5acbd20c4c7d /drivers | |
| parent | adc702e22948ec5fe7b6706d0d66ec3bdd35e323 (diff) | |
| download | u-boot-7b4ea2d888b434c6c07e124a0615da0468624971.zip u-boot-7b4ea2d888b434c6c07e124a0615da0468624971.tar.gz u-boot-7b4ea2d888b434c6c07e124a0615da0468624971.tar.bz2 | |
phy: Fix u-boot coruption when fixed-phy is used
When fixed-link phy is used subnode offset is used as phy address. This
number is bigger then space allocated for bus structure (allocated via
mdio_alloc).
bus->phymap[] array has PHY_MAX_ADDR size (32).
That's why writing bus->phymap[addr] where addr is < 0 or > PHY_MAX_ADDR
is causing write to memory which can caused full U-Boot crash.
The patch is checking if address is in correct range.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/phy/phy.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c index e837eb7..cda4caa 100644 --- a/drivers/net/phy/phy.c +++ b/drivers/net/phy/phy.c @@ -656,7 +656,8 @@ static struct phy_device *phy_device_create(struct mii_dev *bus, int addr, phy_probe(dev); - bus->phymap[addr] = dev; + if (addr >= 0 && addr < PHY_MAX_ADDR) + bus->phymap[addr] = dev; return dev; } |