sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled 

If the gmac0 is disabled, the precheck for a valid ingress device will
cause a NULL pointer deref and crash the system. This happens because
eth->netdev[0] will be NULL but the code will directly try to access
netdev_ops.

Instead of just checking for the first net_device, it must be checked if
any of the mtk_eth net_devices is matching the netdev_ops of the ingress
device.

Cc: stable@vger.kernel.org
Fixes: 73cfd947db ("net: ethernet: mtk_eth_soc: ppe: prevent ppe update for non-mtk devices")
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260324-wed-crash-gmac0-disabled-v1-1-3bc388aee565@simonwunderlich.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Sven Eckelmann (Plasma Cloud) 2026-03-24 09:36:01 +01:00 committed by Jakub Kicinski
parent f73896b419
commit 976ff48c2a
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/net/ethernet/mediatek/mtk_ppe_offload.c
View File

@ -244,6 +244,25 @@ out:
return 0;
}
static bool
mtk_flow_is_valid_idev(const struct mtk_eth *eth, const struct net_device *idev)
{
size_t i;
if (!idev)
return false;
for (i = 0; i < ARRAY_SIZE(eth->netdev); i++) {
if (!eth->netdev[i])
continue;
if (idev->netdev_ops == eth->netdev[i]->netdev_ops)
return true;
}
return false;
}
static int
mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
int ppe_index)
@ -270,7 +289,7 @@ mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
flow_rule_match_meta(rule, &match);
if (mtk_is_netsys_v2_or_greater(eth)) {
idev = __dev_get_by_index(&init_net, match.key->ingress_ifindex);
if (idev && idev->netdev_ops == eth->netdev[0]->netdev_ops) {
if (mtk_flow_is_valid_idev(eth, idev)) {
struct mtk_mac *mac = netdev_priv(idev);
if (WARN_ON(mac->ppe_idx >= eth->soc->ppe_num))