Received: by 2002:ac0:a582:0:0:0:0:0 with SMTP id m2-v6csp4115565imm; Mon, 8 Oct 2018 15:23:22 -0700 (PDT) X-Google-Smtp-Source: ACcGV62YNKVdZ46JswQNAB1OjpVfj2MbLkIZe98Oy3Vqvg1pwwyh3VLFbIFIhY9fC3/LHI1fszDg X-Received: by 2002:a63:8e43:: with SMTP id k64-v6mr22360461pge.75.1539037402424; Mon, 08 Oct 2018 15:23:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1539037402; cv=none; d=google.com; s=arc-20160816; b=JoDyXP7ogKvLrdko9hiIQE4e97iGeyq9GBjn1miqyNWyI/YXiXhZzyY+JO0ZobqbbI QKn+WqSOHPoa2mZyPPoBFjDTTXX+6E9okjSP3llaObpYlyZutFewmeqpF45DdfYiG25o Moz1NebWQjPK8666sJE3XdwNgdQfzOfepKmcOhI9p0EcN0Eglf5CdZgcjDMHe1pMnMll g5pN5xnePLV4nALuPR2e+H2aZIOtQTpWjgmf816LQ6jV415RYnpcsnyBY7/3CaVUXxUb 1ghpLNPpTbnp7B8iQd1hh3byRda79ZYh+ZMzMP06qCY+DzGVsO/9kpE/JpMVwIUl8HK3 Cimg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=Y0cAkYWFzcGB6/6zvuN8YBYtAUk5AOscc+3R6YF7zrE=; b=0DJSrCLzQkllj59tgTdHEZ7Ka67mng66nVhFmng9dKkzhmQvudAAMZVe4GUcDVF8gK Ud26QbDJLWM28M9NqGsjKfPQuBD8VAnAqtHCMZLk4hvw+m1p3p30ZxKDG/G7EHDwZafz uCXX5ppJzVjY0QPjsoPZBP52djPRDK4709wu6UPERAgxduhTy9VVTlm0+t2d3c2FnRpS 7dzyonE5LaG4NBq73kUXb32WysYocXpM/sA3kv8N4EaMdRaF7FUkrp2Q4WvIi97030n1 XYTlU6aG5P68dhlpyATaZwjXl+P8VI/PSwitEEfpF+GpnVd0ewXiFELt3/z7tackb8sB AxXA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 129-v6si18661652pgj.283.2018.10.08.15.23.07; Mon, 08 Oct 2018 15:23:22 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726427AbeJIFgc (ORCPT + 99 others); Tue, 9 Oct 2018 01:36:32 -0400 Received: from gateway22.websitewelcome.com ([192.185.47.79]:21503 "EHLO gateway22.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725808AbeJIFgc (ORCPT ); Tue, 9 Oct 2018 01:36:32 -0400 Received: from cm15.websitewelcome.com (cm15.websitewelcome.com [100.42.49.9]) by gateway22.websitewelcome.com (Postfix) with ESMTP id 23C811C374 for ; Mon, 8 Oct 2018 17:22:38 -0500 (CDT) Received: from gator4166.hostgator.com ([108.167.133.22]) by cmsmtp with SMTP id 9dvBg0Asr8YaU9dvBgS4kb; Mon, 08 Oct 2018 17:22:38 -0500 X-Authority-Reason: nr=8 Received: from 174.206.93.92.rev.sfr.net ([92.93.206.174]:53286 helo=embeddedor) by gator4166.hostgator.com with esmtpa (Exim 4.91) (envelope-from ) id 1g9dvA-00276x-K6; Mon, 08 Oct 2018 17:22:36 -0500 Date: Tue, 9 Oct 2018 00:22:33 +0200 From: "Gustavo A. R. Silva" To: Kishon Vijay Abraham I , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Quentin Schulz , "Gustavo A. R. Silva" Subject: [PATCH 2/2] phy: ocelot-serdes: fix out-of-bounds read Message-ID: <30c1dcb4a8d3707238fcf0a996b9e0bf0a4a7bbc.1539036280.git.gustavo@embeddedor.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 92.93.206.174 X-Source-L: No X-Exim-ID: 1g9dvA-00276x-K6 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: 174.206.93.92.rev.sfr.net (embeddedor) [92.93.206.174]:53286 X-Source-Auth: gustavo@embeddedor.com X-Email-Count: 14 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently, there is an out-of-bounds read on array ctrl->phys, once variable i reaches the maximum array size of SERDES_MAX in the for loop. Fix this by changing the condition in the for loop from i <= SERDES_MAX to i < SERDES_MAX. Addresses-Coverity-ID: 1473966 ("Out-of-bounds read") Addresses-Coverity-ID: 1473959 ("Out-of-bounds read") Fixes: 51f6b410fc22 ("phy: add driver for Microsemi Ocelot SerDes muxing") Signed-off-by: Gustavo A. R. Silva --- drivers/phy/mscc/phy-ocelot-serdes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/phy/mscc/phy-ocelot-serdes.c b/drivers/phy/mscc/phy-ocelot-serdes.c index 8936abd..c4eee3a 100644 --- a/drivers/phy/mscc/phy-ocelot-serdes.c +++ b/drivers/phy/mscc/phy-ocelot-serdes.c @@ -206,7 +206,7 @@ static struct phy *serdes_simple_xlate(struct device *dev, port = args->args[0]; idx = args->args[1]; - for (i = 0; i <= SERDES_MAX; i++) { + for (i = 0; i < SERDES_MAX; i++) { struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]); if (idx != macro->idx) @@ -260,7 +260,7 @@ static int serdes_probe(struct platform_device *pdev) if (!ctrl->regs) return -ENODEV; - for (i = 0; i <= SERDES_MAX; i++) { + for (i = 0; i < SERDES_MAX; i++) { ret = serdes_phy_create(ctrl, i, &ctrl->phys[i]); if (ret) return ret; -- 2.7.4