Commit df0120f1 authored by Heiner Kallweit's avatar Heiner Kallweit Committed by David S. Miller
Browse files

r8169: add check for PHY_MDIO_CHG to rtl_nic_fw_data_ok 



Only values 0 and 1 are currently defined as parameters for
PHY_MDIO_CHG. Instead of silently ignoring unknown values and
misinterpreting the firmware code let's explicitly check.

Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cfccde80

drivers/net/ethernet/realtek/r8169_firmware.c

+10 −5
Original line number Diff line number Diff line
@@ -92,19 +92,24 @@ static bool rtl_fw_data_ok(struct rtl_fw *rtl_fw) 


	for (index = 0; index < pa->size; index++) {

		u32 action = le32_to_cpu(pa->code[index]);

		u32 val = action & 0x0000ffff;

		u32 regno = (action & 0x0fff0000) >> 16;



		switch (action >> 28) {

		case PHY_READ:

		case PHY_DATA_OR:

		case PHY_DATA_AND:

		case PHY_MDIO_CHG:

		case PHY_CLEAR_READCOUNT:

		case PHY_WRITE:

		case PHY_WRITE_PREVIOUS:

		case PHY_DELAY_MS:

			break;



		case PHY_MDIO_CHG:

			if (val > 1)

				goto out;

			break;



		case PHY_BJMPN:

			if (regno > index)

				goto out;
@@ -164,12 +169,12 @@ void rtl_fw_write_firmware(struct rtl8169_private *tp, struct rtl_fw *rtl_fw) 
			index -= (regno + 1);

			break;

		case PHY_MDIO_CHG:

			if (data == 0) {

				fw_write = rtl_fw->phy_write;

				fw_read = rtl_fw->phy_read;

			} else if (data == 1) {

			if (data) {

				fw_write = rtl_fw->mac_mcu_write;

				fw_read = rtl_fw->mac_mcu_read;

			} else {

				fw_write = rtl_fw->phy_write;

				fw_read = rtl_fw->phy_read;

			}



			break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE