e353b0854d
Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value
is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).
This seems correct and aligns with the PTP interrupt status register
(PTP_INT_STS) specifications.
However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with
only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:
lan743x_ptp_io_event_clock_get(..., u8 channel,...)
{
...
/* Update Local timestamp */
extts = &ptp->extts[channel];
extts->ts.tv_sec = sec;
...
}
To avoid an out-of-bounds write and utilize all the supported GPIO
inputs, set LAN743X_PTP_N_EXTTS to 8.
Detected using the static analysis tool - Svace.
Fixes:
|
||
|---|---|---|
| .. | ||
| fdma | ||
| lan865x | ||
| lan966x | ||
| sparx5 | ||
| vcap | ||
| Kconfig | ||
| Makefile | ||
| enc28j60.c | ||
| enc28j60_hw.h | ||
| encx24j600-regmap.c | ||
| encx24j600.c | ||
| encx24j600_hw.h | ||
| lan743x_ethtool.c | ||
| lan743x_ethtool.h | ||
| lan743x_main.c | ||
| lan743x_main.h | ||
| lan743x_ptp.c | ||
| lan743x_ptp.h | ||