From patchwork Thu Jul 20 06:52:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Wang X-Patchwork-Id: 791436 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xCl2D3hHpz9t2h for ; Thu, 20 Jul 2017 16:52:20 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933999AbdGTGwH (ORCPT ); Thu, 20 Jul 2017 02:52:07 -0400 Received: from mailgw01.mediatek.com ([210.61.82.183]:34375 "EHLO mailgw01.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S933214AbdGTGwG (ORCPT ); Thu, 20 Jul 2017 02:52:06 -0400 Received: from mtkcas06.mediatek.inc [(172.21.101.30)] by mailgw01.mediatek.com (envelope-from ) (mhqrelay.mediatek.com ESMTP with TLS) with ESMTP id 832410650; Thu, 20 Jul 2017 14:52:04 +0800 Received: from mtkexhb01.mediatek.inc (172.21.101.102) by mtkmbs08n2.mediatek.inc (172.21.101.56) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 20 Jul 2017 14:52:03 +0800 Received: from mtkswgap22.mediatek.inc (172.21.77.33) by mtkexhb01.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1210.3 via Frontend Transport; Thu, 20 Jul 2017 14:52:03 +0800 From: To: , CC: , , , , Sean Wang Subject: [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access Date: Thu, 20 Jul 2017 14:52:02 +0800 Message-ID: <3a9d3ee4bcfd47487c5dbac4c658f10e0233b723.1500532842.git.sean.wang@mediatek.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 X-MTK: N Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Sean Wang Potential dangerous invalid memory might be accessed if invalid mac value reflected from the forward port field in rxd4 caused by possible potential hardware defects. So added a simple sanity checker to avoid the kind of situation happening. Signed-off-by: Sean Wang Acked-by: John Crispin --- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c index c1dc08c..8175433 100644 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, RX_DMA_FPORT_MASK; mac--; + if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT || + !eth->netdev[mac])) { + netdev->stats.rx_dropped++; + goto release_desc; + } + netdev = eth->netdev[mac]; if (unlikely(test_bit(MTK_RESETTING, ð->state)))