TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
fc27ab4890
twx-linux/drivers
History
Alexey Kodanev e353b0854d net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() 
Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value
is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).
This seems correct and aligns with the PTP interrupt status register
(PTP_INT_STS) specifications.

However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with
only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:

    lan743x_ptp_io_event_clock_get(..., u8 channel,...)
    {
        ...
        /* Update Local timestamp */
        extts = &ptp->extts[channel];
        extts->ts.tv_sec = sec;
        ...
    }

To avoid an out-of-bounds write and utilize all the supported GPIO
inputs, set LAN743X_PTP_N_EXTTS to 8.

Detected using the static analysis tool - Svace.
Fixes: 60942c397af6 ("net: lan743x: Add support for PTP-IO Event Input External Timestamp (extts)")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Acked-by: Rengarajan S <rengarajan.s@microchip.com>
Link: https://patch.msgid.link/20250616113743.36284-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-19 15:32:14 +02:00
..
accel treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
accessibility
acpi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
amba
android Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
ata treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
atm atm: atmtcp: Free invalid length skb in atmtcp_c_send(). 2025-06-17 18:42:44 -07:00
auxdisplay treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
base treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
bcma
block treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
bluetooth Including fixes from bluetooth and wireless. 2025-06-12 09:50:36 -07:00
bus treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cache
cdrom
cdx
char treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
clk I've recently moved computers (among other things) so I'm sending this from a 2025-05-30 09:15:40 -07:00
clocksource MFD for v6.16 2025-06-03 11:53:55 -07:00
comedi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
connector
counter Second set of Counter updates for 6.16 2025-05-24 08:29:32 +02:00
cpufreq treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cpuidle Merge branch 'pm-cpuidle' 2025-05-30 20:21:36 +02:00
crypto treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cxl Merge branch 'for-6.16/cxl-features-ras' into cxl-for-next 2025-05-23 13:26:24 -07:00
dax
dca
devfreq
dio
dma treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
dma-buf treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
dpll
edac CXL changes for v6.16 2025-06-03 13:24:14 -07:00
eisa
extcon
firewire treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
firmware Kbuild updates for v6.16 2025-06-07 10:05:35 -07:00
fpga
fsi
fwctl
gnss
gpio gpio updates for v6.16-rc1 2025-05-27 15:22:01 -07:00
gpu treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
greybus treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hid treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hsi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hte
hv hyperv-next for v6.16 2025-06-03 08:39:20 -07:00
hwmon treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hwspinlock
hwtracing coresight: updates for Linux v6.16 2025-05-22 18:04:43 +02:00
i2c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
i3c i3c: controllers do not need to depend on I3C 2025-05-24 22:49:07 +02:00
idle Power management updates for 6.16-rc1 2025-05-27 16:48:47 -07:00
iio treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
infiniband treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
input treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
interconnect
iommu treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ipack
irqchip dmaengine updates for v6.16 2025-06-05 08:49:30 -07:00
isdn treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
leds treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
macintosh
mailbox treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mcb
md treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
media treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
memory treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
memstick treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
message
mfd MFD for v6.16 2025-06-03 11:53:55 -07:00
misc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mmc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
most treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mtd treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mux
net net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() 2025-06-19 15:32:14 +02:00
nfc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ntb
nubus
nvdimm
nvme treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
nvmem Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
of - The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox 2025-05-31 15:44:16 -07:00
opp
parisc
parport treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
pci The delayed from_timer() API cleanup: 2025-06-08 11:33:00 -07:00
pcmcia treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
peci
perf arm64 updates for 6.16 2025-05-28 14:55:35 -07:00
phy phy-for-6.16 2025-06-05 08:20:21 -07:00
pinctrl pinctrl: sunxi: dt: Consider pin base when calculating bank number from pin 2025-06-10 14:35:40 +02:00
platform treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
pmdomain
pnp
power - The 3 patch series "hung_task: extend blocking task stacktrace dump to 2025-05-31 19:12:53 -07:00
powercap
pps treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ps3
ptp ptp: allow reading of currently dialed frequency to succeed on free-running clocks 2025-06-17 16:13:09 -07:00
pwm pwm: axi-pwmgen: Fix handling of external clock 2025-06-06 13:16:50 -07:00
rapidio
ras
regulator regulator: Fix for v6.16 2025-06-06 13:20:26 -07:00
remoteproc remoteproc updates for v6.16 2025-06-02 11:04:29 -07:00
reset
rpmsg
rtc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
s390 treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
sbus
scsi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
sh
siox
slimbus
soc soc: drivers for 6.16 2025-05-31 07:53:30 -07:00
soundwire soundwire updates for 6.16 2025-06-05 08:07:24 -07:00
spi spi: Updates for v6.16 2025-06-06 13:22:31 -07:00
spmi
ssb
staging treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
target treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
tc
tee
thermal Thermal control updates for 6.16-rc1 2025-05-27 16:28:02 -07:00
thunderbolt
tty treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ufs SCSI misc on 20250606 2025-06-06 20:02:51 -07:00
uio Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
usb treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
vdpa vdpa/octeon_ep: Control PCI dev enabling manually 2025-05-27 10:27:53 -04:00
vfio pci-v6.16-changes 2025-06-04 11:26:17 -07:00
vhost virtio, vhost: features, fixes 2025-05-29 08:15:35 -07:00
video treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
virt treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
virtio virtio_rtc: Add RTC class driver 2025-05-27 10:27:54 -04:00
w1 Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
watchdog treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
xen xen/x86: fix initial memory balloon target 2025-05-23 07:09:00 +02:00
zorro
Kconfig
Makefile