Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934146AbdGTGwI (ORCPT ); Thu, 20 Jul 2017 02:52:08 -0400 Received: from mailgw01.mediatek.com ([210.61.82.183]:34375 "EHLO mailgw01.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S933214AbdGTGwG (ORCPT ); Thu, 20 Jul 2017 02:52:06 -0400 From: To: , CC: , , , , Sean Wang Subject: [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access Date: Thu, 20 Jul 2017 14:52:02 +0800 Message-ID: <3a9d3ee4bcfd47487c5dbac4c658f10e0233b723.1500532842.git.sean.wang@mediatek.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Content-Type: text/plain X-MTK: N Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1025 Lines: 31 From: Sean Wang Potential dangerous invalid memory might be accessed if invalid mac value reflected from the forward port field in rxd4 caused by possible potential hardware defects. So added a simple sanity checker to avoid the kind of situation happening. Signed-off-by: Sean Wang --- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c index c1dc08c..8175433 100644 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, RX_DMA_FPORT_MASK; mac--; + if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT || + !eth->netdev[mac])) { + netdev->stats.rx_dropped++; + goto release_desc; + } + netdev = eth->netdev[mac]; if (unlikely(test_bit(MTK_RESETTING, ð->state))) -- 2.7.4