diff --git a/target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch b/target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch new file mode 100644 index 0000000000..0de8ab4376 --- /dev/null +++ b/target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch @@ -0,0 +1,31 @@ +From: Tom Rix +Date: Sat, 16 Jul 2022 17:46:54 -0400 +Subject: [PATCH] net: ethernet: mtk_eth_soc: fix off by one check of + ARRAY_SIZE + +In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here + struct mtk_wed_ring *ring = &dev->tx_ring[idx]; + +The bounds of idx are checked here + BUG_ON(idx > ARRAY_SIZE(dev->tx_ring)); + +If idx is the size of the array, it will pass this check and overflow. +So change the check to >= . + +Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") +Signed-off-by: Tom Rix +Link: https://lore.kernel.org/r/20220716214654.1540240-1-trix@redhat.com +Signed-off-by: Jakub Kicinski +--- + +--- a/drivers/net/ethernet/mediatek/mtk_wed.c ++++ b/drivers/net/ethernet/mediatek/mtk_wed.c +@@ -651,7 +651,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev + * WDMA RX. + */ + +- BUG_ON(idx > ARRAY_SIZE(dev->tx_ring)); ++ BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring)); + + if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE)) + return -ENOMEM; diff --git a/target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch b/target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch new file mode 100644 index 0000000000..fc6e246468 --- /dev/null +++ b/target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch @@ -0,0 +1,27 @@ +From: Lorenzo Bianconi +Date: Mon, 18 Jul 2022 11:51:53 +0200 +Subject: [PATCH] net: ethernet: mtk_ppe: fix possible NULL pointer dereference + in mtk_flow_get_wdma_info + +odev pointer can be NULL in mtk_flow_offload_replace routine according +to the flower action rules. Fix possible NULL pointer dereference in +mtk_flow_get_wdma_info. + +Fixes: a333215e10cb5 ("net: ethernet: mtk_eth_soc: implement flow offloading to WED devices") +Signed-off-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/4e1685bc4976e21e364055f6bee86261f8f9ee93.1658137753.git.lorenzo@kernel.org +Signed-off-by: Jakub Kicinski +--- + +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -93,6 +93,9 @@ mtk_flow_get_wdma_info(struct net_device + }; + struct net_device_path path = {}; + ++ if (!ctx.dev) ++ return -ENODEV; ++ + memcpy(ctx.daddr, addr, sizeof(ctx.daddr)); + + if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED)) diff --git a/target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch b/target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch new file mode 100644 index 0000000000..c0720152d6 --- /dev/null +++ b/target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch @@ -0,0 +1,64 @@ +From: Lorenzo Bianconi +Date: Fri, 22 Jul 2022 09:06:19 +0200 +Subject: [PATCH] net: ethernet: mtk-ppe: fix traffic offload with bridged wlan + +A typical flow offload scenario for OpenWrt users is routed traffic +received by the wan interface that is redirected to a wlan device +belonging to the lan bridge. Current implementation fails to +fill wdma offload info in mtk_flow_get_wdma_info() since odev device is +the local bridge. Fix the issue running dev_fill_forward_path routine in +mtk_flow_get_wdma_info in order to identify the wlan device. + +Tested-by: Paolo Valerio +Signed-off-by: Lorenzo Bianconi +Signed-off-by: David S. Miller +--- + +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -88,32 +88,28 @@ mtk_flow_offload_mangle_eth(const struct + static int + mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_info *info) + { +- struct net_device_path_ctx ctx = { +- .dev = dev, +- }; +- struct net_device_path path = {}; ++ struct net_device_path_stack stack; ++ struct net_device_path *path; ++ int err; + +- if (!ctx.dev) ++ if (!dev) + return -ENODEV; + +- memcpy(ctx.daddr, addr, sizeof(ctx.daddr)); +- + if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED)) + return -1; + +- if (!dev->netdev_ops->ndo_fill_forward_path) +- return -1; +- +- if (dev->netdev_ops->ndo_fill_forward_path(&ctx, &path)) +- return -1; ++ err = dev_fill_forward_path(dev, addr, &stack); ++ if (err) ++ return err; + +- if (path.type != DEV_PATH_MTK_WDMA) ++ path = &stack.path[stack.num_paths - 1]; ++ if (path->type != DEV_PATH_MTK_WDMA) + return -1; + +- info->wdma_idx = path.mtk_wdma.wdma_idx; +- info->queue = path.mtk_wdma.queue; +- info->bss = path.mtk_wdma.bss; +- info->wcid = path.mtk_wdma.wcid; ++ info->wdma_idx = path->mtk_wdma.wdma_idx; ++ info->queue = path->mtk_wdma.queue; ++ info->bss = path->mtk_wdma.bss; ++ info->wcid = path->mtk_wdma.wcid; + + return 0; + }