net: ethernet: mediatek: avoid potential invalid memory access

Potential dangerous invalid memory might be accessed if invalid mac value
reflected from the forward port field in rxd4 caused by possible potential
hardware defects. So added a simple sanity checker to avoid the kind of
situation happening.

Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Acked-by: John Crispin <john@phrozen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index b3d0c2e6347a636aa23a6f637233d27d7b55f646..3e3232fd7c050e0bc06028d1d0c087e8b0007ae0 100644 (file)
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -947,6 +947,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                      RX_DMA_FPORT_MASK;
                mac--;
 
+               if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
+                            !eth->netdev[mac]))
+                       goto release_desc;
+
                netdev = eth->netdev[mac];
 
                if (unlikely(test_bit(MTK_RESETTING, &eth->state)))