Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755240AbdGVMqO (ORCPT ); Sat, 22 Jul 2017 08:46:14 -0400 Received: from mailgw02.mediatek.com ([210.61.82.184]:63265 "EHLO mailgw02.mediatek.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751328AbdGVMqM (ORCPT ); Sat, 22 Jul 2017 08:46:12 -0400 From: To: , CC: , , , , Sean Wang Subject: [PATCH v2 net] net: ethernet: mediatek: avoid potential invalid memory access Date: Sat, 22 Jul 2017 20:45:55 +0800 Message-ID: X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Content-Type: text/plain X-MTK: N Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1026 Lines: 30 From: Sean Wang Potential dangerous invalid memory might be accessed if invalid mac value reflected from the forward port field in rxd4 caused by possible potential hardware defects. So added a simple sanity checker to avoid the kind of situation happening. Signed-off-by: Sean Wang Acked-by: John Crispin --- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c index c1dc08c..e69524c 100644 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -999,6 +999,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, RX_DMA_FPORT_MASK; mac--; + if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT || + !eth->netdev[mac])) + goto release_desc; + netdev = eth->netdev[mac]; if (unlikely(test_bit(MTK_RESETTING, ð->state))) -- 2.7.4