Commit 8aaf2061 authored by Ingo van Lil's avatar Ingo van Lil Committed by Zhang Changzhong
Browse files

net: phy: dp83869: fix memory corruption when enabling fiber 

stable inclusion
from stable-v5.10.227
commit 21b5af7f0c99b3bf1fd02016e6708b613acbcaf4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUE
CVE: CVE-2024-50188

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=21b5af7f0c99b3bf1fd02016e6708b613acbcaf4



--------------------------------

[ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ]

When configuring the fiber port, the DP83869 PHY driver incorrectly
calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit
number (10). This corrupts some other memory location -- in case of
arm64 the priv pointer in the same structure.

Since the advertising flags are updated from supported at the end of the
function the incorrect line isn't needed at all and can be removed.

Fixes: a29de52b ("net: dp83869: Add ability to advertise Fiber connection")
Signed-off-by: default avatarIngo van Lil <inguin@gmx.de>
Reviewed-by: default avatarAlexander Sverdlin <alexander.sverdlin@siemens.com>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20241002161807.440378-1-inguin@gmx.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent 0912fd81

drivers/net/phy/dp83869.c

+0 −1
Original line number Diff line number Diff line
@@ -610,7 +610,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, 
		     phydev->supported);



	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);

	linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising);



	if (dp83869->mode == DP83869_RGMII_1000_BASE) {

		linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,