Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934131AbdGTHES (ORCPT ); Thu, 20 Jul 2017 03:04:18 -0400 Received: from nbd.name ([46.4.11.11]:51314 "EHLO nbd.name" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751903AbdGTHEQ (ORCPT ); Thu, 20 Jul 2017 03:04:16 -0400 Subject: Re: [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access To: sean.wang@mediatek.com, davem@davemloft.net References: <3a9d3ee4bcfd47487c5dbac4c658f10e0233b723.1500532842.git.sean.wang@mediatek.com> Cc: netdev@vger.kernel.org, nbd@openwrt.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org From: John Crispin Message-ID: <78a7c50a-841b-cf23-558f-f5688692ef17@phrozen.org> Date: Thu, 20 Jul 2017 09:04:01 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.6.0 MIME-Version: 1.0 In-Reply-To: <3a9d3ee4bcfd47487c5dbac4c658f10e0233b723.1500532842.git.sean.wang@mediatek.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1258 Lines: 38 On 20/07/17 08:52, sean.wang@mediatek.com wrote: > From: Sean Wang > > Potential dangerous invalid memory might be accessed if invalid mac value > reflected from the forward port field in rxd4 caused by possible potential > hardware defects. So added a simple sanity checker to avoid the kind of > situation happening. > > Signed-off-by: Sean Wang Thanks, i ran into the same problem last week and was going to send a fix shortly. Acked-by: John Crispin > --- > drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c > index c1dc08c..8175433 100644 > --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c > +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c > @@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, > RX_DMA_FPORT_MASK; > mac--; > > + if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT || > + !eth->netdev[mac])) { > + netdev->stats.rx_dropped++; > + goto release_desc; > + } > + > netdev = eth->netdev[mac]; > > if (unlikely(test_bit(MTK_RESETTING, ð->state)))