Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1692476 > unrolled thread

[PATCH net] net: ethernet: mediatek: avoid potential invalid memory access

Back to article view | Back to linux.kernel

Contents

  [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access <sean.wang@mediatek.com> - 2017-07-20 09:00 +0200
    Re: [PATCH net] net: ethernet: mediatek: avoid potential invalid  memory access John Crispin <john@phrozen.org> - 2017-07-20 09:10 +0200

#1692476 — [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access

From: Sean Wang <sean.wang@mediatek.com>

Potential dangerous invalid memory might be accessed if invalid mac value
reflected from the forward port field in rxd4 caused by possible potential
hardware defects. So added a simple sanity checker to avoid the kind of
situation happening.

Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index c1dc08c..8175433 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
 		      RX_DMA_FPORT_MASK;
 		mac--;
 
+		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
+			     !eth->netdev[mac])) {
+			netdev->stats.rx_dropped++;
+			goto release_desc;
+		}
+
 		netdev = eth->netdev[mac];
 
 		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
-- 
2.7.4

[toc] | [next] | [standalone]

#1692482 — Re: [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access

On 20/07/17 08:52, sean.wang@mediatek.com wrote:
> From: Sean Wang <sean.wang@mediatek.com>
>
> Potential dangerous invalid memory might be accessed if invalid mac value
> reflected from the forward port field in rxd4 caused by possible potential
> hardware defects. So added a simple sanity checker to avoid the kind of
> situation happening.
>
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>

Thanks, i ran into the same problem last week and was going to send a 
fix shortly.

Acked-by: John Crispin <john@phrozen.org>

> ---
>   drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> index c1dc08c..8175433 100644
> --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> @@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
>   		      RX_DMA_FPORT_MASK;
>   		mac--;
>   
> +		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
> +			     !eth->netdev[mac])) {
> +			netdev->stats.rx_dropped++;
> +			goto release_desc;
> +		}
> +
>   		netdev = eth->netdev[mac];
>   
>   		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web