tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

If the gmac0 is disabled, the precheck for a valid ingress device will
cause a NULL pointer deref and crash the system. This happens because
eth->netdev[0] will be NULL but the code will directly try to access
netdev_ops.

Instead of just checking for the first net_device, it must be checked if
any of the mtk_eth net_devices is matching the netdev_ops of the ingress
device.

Cc: stable@vger.kernel.org
Fixes: 73cfd947dbdb ("net: ethernet: mtk_eth_soc: ppe: prevent ppe update for non-mtk devices")
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260324-wed-crash-gmac0-disabled-v1-1-3bc388aee565@simonwunderlich.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Sven Eckelmann (Plasma Cloud) and committed by
Jakub Kicinski 976ff48c f73896b4

+20 -1
+20 -1
drivers/net/ethernet/mediatek/mtk_ppe_offload.c
··· 244 244 return 0; 245 245 } 246 246 247 + static bool 248 + mtk_flow_is_valid_idev(const struct mtk_eth *eth, const struct net_device *idev) 249 + { 250 + size_t i; 251 + 252 + if (!idev) 253 + return false; 254 + 255 + for (i = 0; i < ARRAY_SIZE(eth->netdev); i++) { 256 + if (!eth->netdev[i]) 257 + continue; 258 + 259 + if (idev->netdev_ops == eth->netdev[i]->netdev_ops) 260 + return true; 261 + } 262 + 263 + return false; 264 + } 265 + 247 266 static int 248 267 mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f, 249 268 int ppe_index) ··· 289 270 flow_rule_match_meta(rule, &match); 290 271 if (mtk_is_netsys_v2_or_greater(eth)) { 291 272 idev = __dev_get_by_index(&init_net, match.key->ingress_ifindex); 292 - if (idev && idev->netdev_ops == eth->netdev[0]->netdev_ops) { 273 + if (mtk_flow_is_valid_idev(eth, idev)) { 293 274 struct mtk_mac *mac = netdev_priv(idev); 294 275 295 276 if (WARN_ON(mac->ppe_idx >= eth->soc->ppe_num))