diff mbox

[v2,net] net: ethernet: mediatek: avoid potential invalid memory access

Message ID e5eab7347d0918d7f2aff2951e66f93ef19594cd.1500727290.git.sean.wang@mediatek.com
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Sean Wang July 22, 2017, 12:45 p.m. UTC 
From: Sean Wang <sean.wang@mediatek.com>

Potential dangerous invalid memory might be accessed if invalid mac value
reflected from the forward port field in rxd4 caused by possible potential
hardware defects. So added a simple sanity checker to avoid the kind of
situation happening.

Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Acked-by: John Crispin <john@phrozen.org>
---
 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

David Miller July 24, 2017, 8:44 p.m. UTC | #1 
From: <sean.wang@mediatek.com>
Date: Sat, 22 Jul 2017 20:45:55 +0800

> From: Sean Wang <sean.wang@mediatek.com>
> 
> Potential dangerous invalid memory might be accessed if invalid mac value
> reflected from the forward port field in rxd4 caused by possible potential
> hardware defects. So added a simple sanity checker to avoid the kind of
> situation happening.
> 
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> Acked-by: John Crispin <john@phrozen.org>

Applied.
diff mbox

Patch

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index c1dc08c..e69524c 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -999,6 +999,10 @@  static int mtk_poll_rx(struct napi_struct *napi, int budget,
 		      RX_DMA_FPORT_MASK;
 		mac--;
 
+		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
+			     !eth->netdev[mac]))
+			goto release_desc;
+
 		netdev = eth->netdev[mac];
 
 		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))