From: Haoran Wang Date: Fri, 13 Nov 2026 19:42:25 +0800 Subject: [PATCH net-next] net: sparx5: check DT port reg against array size mchp_sparx5_probe() reads the 'reg' property of each ethernet-port DT node into portno and passes it to sparx5_create_port(), which uses it to index the fixed-size sparx5->ports[SPX5_PORTS] array: sparx5->ports[config->portno] = spx5_port; The value is never validated, so a device tree with an out-of-range 'reg' value (runtime overlay, corrupted or attacker-controlled DTB, kexec-supplied or bootloader-fixed-up DT) turns probe into an out-of-bounds write, potentially far outside the allocation. Add a range check while parsing and skip nodes with an invalid port number. Fixes: f3cad2611a77 ("net: sparx5: add hostmode with phylink support") Signed-off-by: Haoran Wang --- drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c index 08a398adf121..6616e76bd0e3 100644 --- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c +++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c @@ -845,6 +845,11 @@ static int mchp_sparx5_probe(struct platform_device *pdev) dev_err(sparx5->dev, "port reg property error\n"); continue; } + if (portno >= SPX5_PORTS) { + dev_err(sparx5->dev, "port %u: reg out of range\n", + portno); + continue; + } config = &configs[idx]; conf = &config->conf; conf->speed = SPEED_UNKNOWN; -- 2.43.0