Commit 491e4b02 authored by Hangyu Hua's avatar Hangyu Hua Committed by sanglipeng
Browse files

net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() 

stable inclusion
from stable-v5.10.195
commit 75f2de75c1182e80708c932418e4895dbc88b68f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I95JOC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=75f2de75c1182e80708c932418e4895dbc88b68f



--------------------------------

[ Upstream commit e4c79810 ]

rule_locs is allocated in ethtool_get_rxnfc and the size is determined by
rule_cnt from user space. So rule_cnt needs to be check before using
rule_locs to avoid NULL pointer dereference.

Fixes: 7aab747e ("net: ethernet: mediatek: add ethtool functions to configure RX flows of HW LRO")
Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 3c70144e

drivers/net/ethernet/mediatek/mtk_eth_soc.c

+3 −0
Original line number Diff line number Diff line
@@ -2013,6 +2013,9 @@ static int mtk_hwlro_get_fdir_all(struct net_device *dev, 
	int i;



	for (i = 0; i < MTK_MAX_LRO_IP_CNT; i++) {

		if (cnt == cmd->rule_cnt)

			return -EMSGSIZE;



		if (mac->hwlro_ip[i]) {

			rule_locs[cnt] = i;

			cnt++;