net: mdio: realtek-rtl9300: harden otto_emdio_map_ports()

Due to its design the MDIO driver needs to set up a port to bus/address
mapping during probing. The "ethernet-ports" subnodes are scanned and
from the "phy-handle" property the MDIO nodes are looked up. In case of
a malformed device tree the driver might produce out-of-bounds accesses.
The PHY address is not checked against the maximum supported address.

Add a sanity check and drop the unneeded MAX_SMI_ADDR define.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://patch.msgid.link/20260603175924.123019-3-markus.stockhausen@gmx.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
index a280363593d2b9dfa76d67c23952b4b42a7c360c..ba4151fbae0d4a6f5467e7e499c6e83bea113952 100644 (file)
--- a/drivers/net/mdio/mdio-realtek-rtl9300.c
+++ b/drivers/net/mdio/mdio-realtek-rtl9300.c
@@ -78,7 +78,6 @@
 
 #define MAX_PORTS       28
 #define MAX_SMI_BUSSES  4
-#define MAX_SMI_ADDR   0x1f
 #define RAW_PAGE(priv) ((priv)->info->num_pages - 1)
 
 
@@ -430,8 +429,8 @@ static int otto_emdio_map_ports(struct device *dev)
        struct device_node *ports_dn, *phy_dn, *bus_dn, *ctrl_dn;
        struct otto_emdio_priv *priv = dev_get_drvdata(dev);
        struct device *parent = dev->parent;
-       u32 addr, bus, pn;
-       int err = 0;
+       int addr, err = 0;
+       u32 bus, pn;
 
        ports_dn = of_get_child_by_name(parent->of_node, "ethernet-ports");
        if (!ports_dn)
@@ -478,9 +477,11 @@ static int otto_emdio_map_ports(struct device *dev)
                        goto put_nodes;
                }
 
-               err = of_property_read_u32(phy_dn, "reg", &addr);
-               if (err)
+               addr = of_mdio_parse_addr(dev, phy_dn);
+               if (addr < 0) {
+                       err = addr;
                        goto put_nodes;
+               }
 
                __set_bit(pn, priv->valid_ports);
                priv->smi_bus[pn] = bus;