linux-kernel - Re: [PATCH net] net: ethernet: mediatek: avoid potential invalid memory access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <78a7c50a-841b-cf23-558f-f5688692ef17@phrozen.org>
Date:   Thu, 20 Jul 2017 09:04:01 +0200
From:   John Crispin <john@...ozen.org>
To:     sean.wang@...iatek.com, davem@...emloft.net
Cc:     netdev@...r.kernel.org, nbd@...nwrt.org,
        linux-mediatek@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: ethernet: mediatek: avoid potential invalid
 memory access



On 20/07/17 08:52, sean.wang@...iatek.com wrote:
> From: Sean Wang <sean.wang@...iatek.com>
>
> Potential dangerous invalid memory might be accessed if invalid mac value
> reflected from the forward port field in rxd4 caused by possible potential
> hardware defects. So added a simple sanity checker to avoid the kind of
> situation happening.
>
> Signed-off-by: Sean Wang <sean.wang@...iatek.com>

Thanks, i ran into the same problem last week and was going to send a 
fix shortly.

Acked-by: John Crispin <john@...ozen.org>

> ---
>   drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> index c1dc08c..8175433 100644
> --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> @@ -999,6 +999,12 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
>   		      RX_DMA_FPORT_MASK;
>   		mac--;
>   
> +		if (unlikely(mac < 0 || mac >= MTK_MAC_COUNT ||
> +			     !eth->netdev[mac])) {
> +			netdev->stats.rx_dropped++;
> +			goto release_desc;
> +		}
> +
>   		netdev = eth->netdev[mac];
>   
>   		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))