kern/60964: micphy(4): softc allocation is too small

["trythepostoffice%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60964
>Category:       kern
>Synopsis:       micphy(4): softc allocation is too small
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 04 22:25:00 +0000 2026
>Originator:     Elias Howell
>Release:        NetBSD-current 11.99.9 (20261103)
>Organization:
>Environment:
NetBSD armv7 11.99.9 NetBSD 11.99.9 (GENERIC) #2: Wed Nov  4 11:15:42 CST 2026  ehowell@A36x2xLAPTOP:/home/ehowell/netbsd/obj-dualemac/sys/arch/evbarm/compile/GENERIC evbarm
>Description:
micphy.c has

  CFATTACH_DECL_NEW(micphy, sizeof(struct mii_softc),
      micphymatch, micphyattach, mii_phy_detach, mii_phy_activate);

but micphyattach() and micphy_status() take device_private() as a
struct micphy_softc which is the mii_softc with sc_lstype after it.
micphyattach() sets sc_lstype for every PHY so every attach writes
past the end of the softc, and micphy_status() reads it on every
status poll

Found reading the code while working on cpsw for the SG-1000. I
haven't seen it break anything. I didn't check 11.0.

>How-To-Repeat:
Read sys/dev/mii/micphy.c rev 1.17 the CFATTACH_DECL_NEW near the
top and struct micphy_softc right below it
>Fix:
Use sizeof(struct micphy_softc). the CFATTACH_DECL_NEW has to move
below the struct for that.

--- a/sys/dev/mii/micphy.c
+++ b/sys/dev/mii/micphy.c
@@ -82,9 +82,6 @@ static void   micphyattach(device_t, device_t, void *);
 static void    micphy_reset(struct mii_softc *);
 static int     micphy_service(struct mii_softc *, struct mii_data *, int);

-CFATTACH_DECL_NEW(micphy, sizeof(struct mii_softc),
-    micphymatch, micphyattach, mii_phy_detach, mii_phy_activate);
-
 static int     micphy_service(struct mii_softc *, struct mii_data *, int);
 static void    micphy_status(struct mii_softc *);
 static void    micphy_fixup(struct mii_softc *, int, int, device_t);
@@ -98,6 +95,9 @@ struct micphy_softc {
        uint32_t sc_lstype;     /* Type of link status register */
 };

+CFATTACH_DECL_NEW(micphy, sizeof(struct micphy_softc),
+    micphymatch, micphyattach, mii_phy_detach, mii_phy_activate);
+
 static const struct mii_phydesc micphys[] = {
        MII_PHY_DESC(MICREL, KSZ8041),
        MII_PHY_DESC(MICREL, KSZ8051), /* +8021,8031 */