From: David Yang Date: Sat, 30 May 2026 00:39:14 +0000 (+0800) Subject: net: dsa: sja1105: flower: reject cross-chip redirect X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0;p=thirdparty%2Flinux.git net: dsa: sja1105: flower: reject cross-chip redirect dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count. Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here. Signed-off-by: David Yang Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260530003940.2000994-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski --- diff --git a/drivers/net/dsa/sja1105/sja1105_flower.c b/drivers/net/dsa/sja1105/sja1105_flower.c index fba926f85b47..7547999a113f 100644 --- a/drivers/net/dsa/sja1105/sja1105_flower.c +++ b/drivers/net/dsa/sja1105/sja1105_flower.c @@ -391,9 +391,9 @@ int sja1105_cls_flower_add(struct dsa_switch *ds, int port, struct dsa_port *to_dp; to_dp = dsa_port_from_netdev(act->dev); - if (IS_ERR(to_dp)) { + if (IS_ERR(to_dp) || to_dp->ds != ds) { NL_SET_ERR_MSG_MOD(extack, - "Destination not a switch port"); + "Destination not a local switch port"); return -EOPNOTSUPP; }