From: Michal Simek <michal.simek@xilinx.com>
Date: Wed, 19 Dec 2018 15:57:38 +0000 (+0100)
Subject: phy: Fix u-boot coruption when fixed-phy is used
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=7b4ea2d888b434c6c07e124a0615da0468624971;p=project%2Fbcm63xx%2Fu-boot.git

phy: Fix u-boot coruption when fixed-phy is used

When fixed-link phy is used subnode offset is used as phy address. This
number is bigger then space allocated for bus structure (allocated via
mdio_alloc).
bus->phymap[] array has PHY_MAX_ADDR size (32).
That's why writing bus->phymap[addr] where addr is < 0 or > PHY_MAX_ADDR
is causing write to memory which can caused full U-Boot crash.

The patch is checking if address is in correct range.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
---

diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e837eb7688..cda4caa803 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -656,7 +656,8 @@ static struct phy_device *phy_device_create(struct mii_dev *bus, int addr,
 
 	phy_probe(dev);
 
-	bus->phymap[addr] = dev;
+	if (addr >= 0 && addr < PHY_MAX_ADDR)
+		bus->phymap[addr] = dev;
 
 	return dev;
 }