On 20/07/17 08:52, [email protected] wrote:
From: Sean Wang <[email protected]> Potential dangerous invalid memory might be accessed if invalid mac value reflected from the forward port field in rxd4 caused by possible potential hardware defects. So added a simple sanity checker to avoid the kind of situation happening. Signed-off-by: Sean Wang <[email protected]>
Thanks, i ran into the same problem last week and was going to send a fix shortly.
Acked-by: John Crispin <[email protected]>
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c index c1dc08c..8175433 100644 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, RX_DMA_FPORT_MASK; mac--;+ if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||+ !eth->netdev[mac])) { + netdev->stats.rx_dropped++; + goto release_desc; + } + netdev = eth->netdev[mac];if (unlikely(test_bit(MTK_RESETTING, ð->state)))
