net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled

If the gmac0 is disabled, the precheck for a valid ingress device will
cause a NULL pointer deref and crash the system. This happens because
eth->netdev[0] will be NULL but the code will directly try to access
netdev_ops.

Instead of just checking for the first net_device, it must be checked if
any of the mtk_eth net_devices is matching the netdev_ops of the ingress
device.

Cc: stable@vger.kernel.org
Fixes: 73cfd947dbdb ("net: ethernet: mtk_eth_soc: ppe: prevent ppe update for non-mtk devices")
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260324-wed-crash-gmac0-disabled-v1-1-3bc388aee565@simonwunderlich.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
index cb30108f2bf67efae3133b483d84b436877c394f..cc8c4ef8038f3099823d5494fedc3ec2a2fc91b6 100644 (file)
--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
@@ -244,6 +244,25 @@ out:
        return 0;
 }
 
+static bool
+mtk_flow_is_valid_idev(const struct mtk_eth *eth, const struct net_device *idev)
+{
+       size_t i;
+
+       if (!idev)
+               return false;
+
+       for (i = 0; i < ARRAY_SIZE(eth->netdev); i++) {
+               if (!eth->netdev[i])
+                       continue;
+
+               if (idev->netdev_ops == eth->netdev[i]->netdev_ops)
+                       return true;
+       }
+
+       return false;
+}
+
 static int
 mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
                         int ppe_index)
@@ -270,7 +289,7 @@ mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
                flow_rule_match_meta(rule, &match);
                if (mtk_is_netsys_v2_or_greater(eth)) {
                        idev = __dev_get_by_index(&init_net, match.key->ingress_ifindex);
-                       if (idev && idev->netdev_ops == eth->netdev[0]->netdev_ops) {
+                       if (mtk_flow_is_valid_idev(eth, idev)) {
                                struct mtk_mac *mac = netdev_priv(idev);
 
                                if (WARN_ON(mac->ppe_idx >= eth->soc->ppe_num))