* [PATCH net-next v3 1/2] net: pcs: rzn1-miic: Update port numbering for RZ/T2H
2026-10-06 16:48 [PATCH net-next v3 0/2] net: pcs: rzn1-miic: Validate dtb configuration values Kyle Hendry via B4 Relay
@ 2026-10-06 16:48 ` Kyle Hendry via B4 Relay
2026-10-09 14:22 ` Simon Horman
2026-10-06 16:48 ` [PATCH net-next v3 2/2] net: pcs: rzn1-miic: Validate dtb configuration values Kyle Hendry via B4 Relay
1 sibling, 1 reply; 5+ messages in thread
From: Kyle Hendry via B4 Relay @ 2026-10-06 16:48 UTC (permalink / raw)
To: Clément Léger, Andrew Lunn, Heiner Kallweit,
Russell King, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Geert Uytterhoeven, Magnus Damm, Lad Prabhakar
Cc: linux-renesas-soc, netdev, linux-kernel, Kyle Hendry
From: Kyle Hendry <khendry@reliablecontrols.com>
The port numbers on the RZ/T2H are documented as 0 to 3. Update the info
structure and change the member name to miic_port_last to be more accurate.
This value was being used as the number of miic registers when setting
default values. Add logic to get the total port count and loop over that.
Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
---
drivers/net/pcs/pcs-rzn1-miic.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
index 3aa513467060..31716241b58f 100644
--- a/drivers/net/pcs/pcs-rzn1-miic.c
+++ b/drivers/net/pcs/pcs-rzn1-miic.c
@@ -222,7 +222,7 @@ enum miic_type {
* @index_to_string: String representations of the index values
* @index_to_string_count: Number of entries in the index_to_string array
* @miic_port_start: MIIC port start number
- * @miic_port_max: Maximum MIIC supported
+ * @miic_port_last: MIIC port last number
* @sw_mode_mask: Switch mode mask
* @reset_ids: Reset names array
* @reset_count: Number of entries in the reset_ids array
@@ -240,7 +240,7 @@ struct miic_of_data {
const char * const *index_to_string;
u8 index_to_string_count;
u8 miic_port_start;
- u8 miic_port_max;
+ u8 miic_port_last;
u8 sw_mode_mask;
const char * const *reset_ids;
u8 reset_count;
@@ -485,7 +485,7 @@ struct phylink_pcs *miic_create(struct device *dev, struct device_node *np)
miic = platform_get_drvdata(pdev);
of_data = miic->of_data;
- if (port > of_data->miic_port_max || port < of_data->miic_port_start) {
+ if (port > of_data->miic_port_last || port < of_data->miic_port_start) {
put_device(&pdev->dev);
return ERR_PTR(-EINVAL);
}
@@ -523,6 +523,7 @@ EXPORT_SYMBOL(miic_destroy);
static int miic_init_hw(struct miic *miic, u32 cfg_mode)
{
u8 sw_mode_mask = miic->of_data->sw_mode_mask;
+ int num_ports;
int port;
/* Unlock write access to accessory registers (cf datasheet). If this
@@ -538,7 +539,10 @@ static int miic_init_hw(struct miic *miic, u32 cfg_mode)
miic_reg_writel(miic, MIIC_MODCTRL,
((cfg_mode << __ffs(sw_mode_mask)) & sw_mode_mask));
- for (port = 0; port < miic->of_data->miic_port_max; port++) {
+ num_ports = miic->of_data->miic_port_last -
+ miic->of_data->miic_port_start + 1;
+
+ for (port = 0; port < num_ports; port++) {
miic_converter_enable(miic, port, 0);
/* Disable speed/duplex control from these registers, datasheet
* says switch registers should be used to setup switch port
@@ -825,7 +829,7 @@ static struct miic_of_data rzn1_miic_of_data = {
.index_to_string = index_to_string,
.index_to_string_count = ARRAY_SIZE(index_to_string),
.miic_port_start = 1,
- .miic_port_max = 5,
+ .miic_port_last = 5,
.sw_mode_mask = GENMASK(4, 0),
.init_unlock_lock_regs = true,
.miic_write = miic_reg_writel_unlocked,
@@ -841,7 +845,7 @@ static struct miic_of_data rzt2h_miic_of_data = {
.index_to_string = rzt2h_index_to_string,
.index_to_string_count = ARRAY_SIZE(rzt2h_index_to_string),
.miic_port_start = 0,
- .miic_port_max = 4,
+ .miic_port_last = 3,
.sw_mode_mask = GENMASK(2, 0),
.reset_ids = rzt2h_reset_ids,
.reset_count = ARRAY_SIZE(rzt2h_reset_ids),
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH net-next v3 2/2] net: pcs: rzn1-miic: Validate dtb configuration values
2026-10-06 16:48 [PATCH net-next v3 0/2] net: pcs: rzn1-miic: Validate dtb configuration values Kyle Hendry via B4 Relay
2026-10-06 16:48 ` [PATCH net-next v3 1/2] net: pcs: rzn1-miic: Update port numbering for RZ/T2H Kyle Hendry via B4 Relay
@ 2026-10-06 16:48 ` Kyle Hendry via B4 Relay
2026-10-09 14:26 ` Simon Horman
1 sibling, 1 reply; 5+ messages in thread
From: Kyle Hendry via B4 Relay @ 2026-10-06 16:48 UTC (permalink / raw)
To: Clément Léger, Andrew Lunn, Heiner Kallweit,
Russell King, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Geert Uytterhoeven, Magnus Damm, Lad Prabhakar
Cc: linux-renesas-soc, netdev, linux-kernel, Kyle Hendry
From: Kyle Hendry <khendry@reliablecontrols.com>
Bad configuration values from the dtb could result in out of bounds array
access. Verify parsed values are within range for the SoC and fail the
probe if invalid.
Signed-off-by: Kyle Hendry <khendry@reliablecontrols.com>
---
drivers/net/pcs/pcs-rzn1-miic.c | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
index 31716241b58f..10622eb654d2 100644
--- a/drivers/net/pcs/pcs-rzn1-miic.c
+++ b/drivers/net/pcs/pcs-rzn1-miic.c
@@ -693,16 +693,40 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
memset(dt_val, MIIC_MODCTRL_CONF_NONE,
sizeof(*dt_val) * miic->of_data->conf_conv_count);
- if (of_property_read_u32(np, "renesas,miic-switch-portin", &conf) == 0)
- dt_val[0] = conf;
+ if (of_property_read_u32(np, "renesas,miic-switch-portin", &conf) == 0) {
+ if (conf >= miic->of_data->conf_to_string_count) {
+ dev_err(miic->dev, "Port input configuration out of range: %d\n",
+ conf);
+ ret = -EINVAL;
+ goto err;
+ } else {
+ dt_val[0] = conf;
+ }
+ }
for_each_available_child_of_node(np, conv) {
if (of_property_read_u32(conv, "reg", &port))
continue;
+ if (port < miic->of_data->miic_port_start ||
+ port > miic->of_data->miic_port_last) {
+ dev_err(miic->dev, "Port number out of range: %d\n", port);
+ of_node_put(conv);
+ ret = -EINVAL;
+ goto err;
+ }
+
if (of_property_read_u32(conv, "renesas,miic-input", &conf))
continue;
+ if (conf >= miic->of_data->conf_to_string_count) {
+ dev_err(miic->dev, "Port %d configuration out of range: %d\n",
+ port, conf);
+ of_node_put(conv);
+ ret = -EINVAL;
+ goto err;
+ }
+
/* Adjust for 0 based index */
dt_val[port + !miic->of_data->miic_port_start] = conf;
@@ -712,6 +736,7 @@ static int miic_parse_dt(struct miic *miic, u32 *mode_cfg)
}
ret = miic_match_dt_conf(miic, dt_val, mode_cfg);
+err:
kfree(dt_val);
return ret;
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread