[PATCH net-next] net: sparx5: check DT port reg against array size

[Haoran Wang <haoranwangsec@gmail.com>]

From: Haoran Wang <wanghr2026@mail.zgclab.edu.cn>
Date: Fri, 13 Nov 2026 19:42:25 +0800
Subject: [PATCH net-next] net: sparx5: check DT port reg against array size

mchp_sparx5_probe() reads the 'reg' property of each ethernet-port DT
node into portno and passes it to sparx5_create_port(), which uses it
to index the fixed-size sparx5->ports[SPX5_PORTS] array:

    sparx5->ports[config->portno] = spx5_port;

The value is never validated, so a device tree with an out-of-range
'reg' value (runtime overlay, corrupted or attacker-controlled DTB,
kexec-supplied or bootloader-fixed-up DT) turns probe into an
out-of-bounds write, potentially far outside the allocation.

Add a range check while parsing and skip nodes with an invalid port
number.

Fixes: f3cad2611a77 ("net: sparx5: add hostmode with phylink support")
Signed-off-by: Haoran Wang <wanghr2026@mail.zgclab.edu.cn>
---
 drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
index 08a398adf121..6616e76bd0e3 100644
--- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
@@ -845,6 +845,11 @@ static int mchp_sparx5_probe(struct platform_device *pdev)
 			dev_err(sparx5->dev, "port reg property error\n");
 			continue;
 		}
+		if (portno >= SPX5_PORTS) {
+			dev_err(sparx5->dev, "port %u: reg out of range\n",
+				portno);
+			continue;
+		}
 		config = &configs[idx];
 		conf = &config->conf;
 		conf->speed = SPEED_UNKNOWN;
--
2.43.0