From 2c5ac026fd1421cf6a78770b48570b2563ef40b7 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Mon, 24 Mar 2025 16:39:29 +0200 Subject: [PATCH 1/2] =?UTF-8?q?net:=20phy:=20Introduce=20PHY=5FID=5FSIZE?= =?UTF-8?q?=20=E2=80=94=20minimum=20size=20for=20PHY=20ID=20string?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PHY_ID_FMT defines the format specifier "%s:%02x" to form the PHY ID string, where the maximum of the first part is defined in MII_BUS_ID_SIZE, including NUL terminator, and the second part is implied to be 3 as the maximum address is limited to 32, meaning that 2 hex digits is more than enough, plus ':' (colon) delimiter. However, some drivers, which are using PHY_ID_FMT, customise buffer size and do that incorrectly. Introduce a new constant PHY_ID_SIZE that makes the minimum required size explicit, so drivers are encouraged to use it. Suggested-by: "Russell King (Oracle)" Signed-off-by: Andy Shevchenko Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250324144751.1271761-2-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski --- include/linux/phy.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/phy.h b/include/linux/phy.h index bfdbdc538910..a2bfae80c449 100644 --- a/include/linux/phy.h +++ b/include/linux/phy.h @@ -292,6 +292,7 @@ static inline long rgmii_clock(int speed) /* Used when trying to connect to a specific phy (mii bus id:phy device id) */ #define PHY_ID_FMT "%s:%02x" +#define PHY_ID_SIZE (MII_BUS_ID_SIZE + 3) #define MII_BUS_ID_SIZE 61 From 61997271a5a7dcd5a7dd5f0d81e4cb045e1db9ef Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Mon, 24 Mar 2025 16:39:30 +0200 Subject: [PATCH 2/2] net: usb: asix: ax88772: Increase phy_name size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GCC compiler (Debian 14.2.0-17) is not happy about printing into a too short buffer (when build with `make W=1`): drivers/net/usb/ax88172a.c:311:9: note: ‘snprintf’ output between 4 and 66 bytes into a destination of size 20 Indeed, the buffer size is chosen based on some assumptions, while in general the assigned name might not fit. Increase the buffer size to cover the minimum required one. With that, change snprintf() to use sizeof() instead of the hard coded value. While at it, make sure that the PHY address is not bigger than the allowed maximum. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250324144751.1271761-3-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski --- drivers/net/usb/ax88172a.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c index e47bb125048d..f613e4bc68c8 100644 --- a/drivers/net/usb/ax88172a.c +++ b/drivers/net/usb/ax88172a.c @@ -18,8 +18,8 @@ struct ax88172a_private { struct mii_bus *mdio; struct phy_device *phydev; - char phy_name[20]; - u16 phy_addr; + char phy_name[PHY_ID_SIZE]; + u8 phy_addr; u16 oldmode; int use_embdphy; struct asix_rx_fixup_info rx_fixup_info; @@ -210,7 +210,11 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) ret = asix_read_phy_addr(dev, priv->use_embdphy); if (ret < 0) goto free; - + if (ret >= PHY_MAX_ADDR) { + netdev_err(dev->net, "Invalid PHY address %#x\n", ret); + ret = -ENODEV; + goto free; + } priv->phy_addr = ret; ax88172a_reset_phy(dev, priv->use_embdphy); @@ -308,7 +312,7 @@ static int ax88172a_reset(struct usbnet *dev) rx_ctl); /* Connect to PHY */ - snprintf(priv->phy_name, 20, PHY_ID_FMT, + snprintf(priv->phy_name, sizeof(priv->phy_name), PHY_ID_FMT, priv->mdio->id, priv->phy_addr); priv->phydev = phy_connect(dev->net, priv->phy_name,