From: Markus Stockhausen <markus.stockhausen@gmx.de>
Date: Wed, 3 Jun 2026 17:59:19 +0000 (+0200)
Subject: net: mdio: realtek-rtl9300: harden otto_emdio_map_ports()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=829ee0f8bc3920092b06d32d9e05328395ed5b77;p=thirdparty%2Flinux.git

net: mdio: realtek-rtl9300: harden otto_emdio_map_ports()

Due to its design the MDIO driver needs to set up a port to bus/address
mapping during probing. The "ethernet-ports" subnodes are scanned and
from the "phy-handle" property the MDIO nodes are looked up. In case of
a malformed device tree the driver might produce out-of-bounds accesses.
The PHY address is not checked against the maximum supported address.

Add a sanity check and drop the unneeded MAX_SMI_ADDR define.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://patch.msgid.link/20260603175924.123019-3-markus.stockhausen@gmx.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
index a280363593d2b..ba4151fbae0d4 100644
--- a/drivers/net/mdio/mdio-realtek-rtl9300.c
+++ b/drivers/net/mdio/mdio-realtek-rtl9300.c
@@ -78,7 +78,6 @@
 
 #define MAX_PORTS       28
 #define MAX_SMI_BUSSES  4
-#define MAX_SMI_ADDR	0x1f
 #define RAW_PAGE(priv)	((priv)->info->num_pages - 1)
 
 
@@ -430,8 +429,8 @@ static int otto_emdio_map_ports(struct device *dev)
 	struct device_node *ports_dn, *phy_dn, *bus_dn, *ctrl_dn;
 	struct otto_emdio_priv *priv = dev_get_drvdata(dev);
 	struct device *parent = dev->parent;
-	u32 addr, bus, pn;
-	int err = 0;
+	int addr, err = 0;
+	u32 bus, pn;
 
 	ports_dn = of_get_child_by_name(parent->of_node, "ethernet-ports");
 	if (!ports_dn)
@@ -478,9 +477,11 @@ static int otto_emdio_map_ports(struct device *dev)
 			goto put_nodes;
 		}
 
-		err = of_property_read_u32(phy_dn, "reg", &addr);
-		if (err)
+		addr = of_mdio_parse_addr(dev, phy_dn);
+		if (addr < 0) {
+			err = addr;
 			goto put_nodes;
+		}
 
 		__set_bit(pn, priv->valid_ports);
 		priv->smi_bus[pn] = bus;