diff options
| author | Yuichiro Tsuji <[email protected]> | 2025-08-18 08:45:07 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2025-08-20 00:52:29 +0000 |
| commit | 24ef2f53c07f273bad99173e27ee88d44d135b1c (patch) | |
| tree | b21233b317a4569bc87aa6119e58159417041401 /drivers/net/usb/asix_devices.c | |
| parent | phy: mscc: Fix timestamping for vsc8584 (diff) | |
| download | kernel-24ef2f53c07f273bad99173e27ee88d44d135b1c.tar.gz kernel-24ef2f53c07f273bad99173e27ee88d44d135b1c.zip | |
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.
The PHY address should be masked to 5 bits (0-31). Without this
mask, invalid PHY addresses could be used, potentially causing issues
with MDIO bus operations.
Fix this by masking the PHY address with 0x1f (31 decimal) to ensure
it stays within the valid range.
Fixes: 4faff70959d5 ("net: usb: asix_devices: add phy_mask for ax88772 mdio bus")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=20537064367a0f98d597
Tested-by: [email protected]
Signed-off-by: Yuichiro Tsuji <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'drivers/net/usb/asix_devices.c')
| -rw-r--r-- | drivers/net/usb/asix_devices.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c index d9f5942ccc44..792ddda1ad49 100644 --- a/drivers/net/usb/asix_devices.c +++ b/drivers/net/usb/asix_devices.c @@ -676,7 +676,7 @@ static int ax88772_init_mdio(struct usbnet *dev) priv->mdio->read = &asix_mdio_bus_read; priv->mdio->write = &asix_mdio_bus_write; priv->mdio->name = "Asix MDIO Bus"; - priv->mdio->phy_mask = ~(BIT(priv->phy_addr) | BIT(AX_EMBD_PHY_ADDR)); + priv->mdio->phy_mask = ~(BIT(priv->phy_addr & 0x1f) | BIT(AX_EMBD_PHY_ADDR)); /* mii bus name is usb-<usb bus number>-<usb device number> */ snprintf(priv->mdio->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", dev->udev->bus->busnum, dev->udev->devnum); |