net: ethernet: mediatek: avoid potential invalid memory access
authorSean Wang <sean.wang@mediatek.com>
Sat, 22 Jul 2017 12:45:55 +0000 (20:45 +0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 24 Jul 2017 20:43:23 +0000 (13:43 -0700)
Potential dangerous invalid memory might be accessed if invalid mac value
reflected from the forward port field in rxd4 caused by possible potential
hardware defects. So added a simple sanity checker to avoid the kind of
situation happening.

Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Acked-by: John Crispin <john@phrozen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/mediatek/mtk_eth_soc.c

index b3d0c2e6347a636aa23a6f637233d27d7b55f646..3e3232fd7c050e0bc06028d1d0c087e8b0007ae0 100644 (file)
@@ -947,6 +947,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                      RX_DMA_FPORT_MASK;
                mac--;
 
+               if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
+                            !eth->netdev[mac]))
+                       goto release_desc;
+
                netdev = eth->netdev[mac];
 
                if (unlikely(test_bit(MTK_RESETTING, &eth->state)))