commit 6c7fce6fa86a110d6455662d823c4e09f8f7be4a
author Sean Wang <sean.wang@mediatek.com> Sat Jul 22 20:45:55 2017 +0800
committer David S. Miller <davem@davemloft.net> Mon Jul 24 13:43:23 2017 -0700
tree 038a3d9491954e109acb58200ef3129b96e38dbd
parent 96080f697786e0a30006fcbcc5b53f350fcb3e9f

net: ethernet: mediatek: avoid potential invalid memory access

Potential dangerous invalid memory might be accessed if invalid mac value
reflected from the forward port field in rxd4 caused by possible potential
hardware defects. So added a simple sanity checker to avoid the kind of
situation happening.

Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Acked-by: John Crispin <john@phrozen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/ethernet/mediatek/mtk_eth_soc.c

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index b3d0c2e..3e3232f 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -947,6 +947,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
 		      RX_DMA_FPORT_MASK;
 		mac--;
 
+		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
+			     !eth->netdev[mac]))
+			goto release_desc;
+
 		netdev = eth->netdev[mac];
 
 		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))