[PATCH net] net: dsa: bcm_sf2_cfp: fix NULL deref when port_num is out of bounds

[PATCH net] net: dsa: bcm_sf2_cfp: fix NULL deref when port_num is out of bounds

[Danesh Petigara]

From: Justin Chen <justin.chen@broadcom.com>

bcm_sf2_cfp_rule_insert() validates port_num against
priv->hw_params.num_ports, but the bounds check was placed after the
calls to dsa_is_user_port() and dsa_is_cpu_port():

    if (ring_cookie == RX_CLS_FLOW_DISC ||
        !(dsa_is_user_port(ds, port_num) ||
          dsa_is_cpu_port(ds, port_num)) ||
        port_num >= priv->hw_params.num_ports)

Both helpers call dsa_to_port(), which iterates the port list and
returns NULL if no entry matches.  With a user-supplied ring_cookie
large enough to produce an out-of-bounds port_num, dsa_to_port()
returns NULL and the immediate ->type dereference faults.

Move the bounds check first so dsa_is_user_port()/dsa_is_cpu_port()
are never reached with an invalid port_num.

Fixes: 4a5b85ffe2a0 ("net: dsa: use dsa_is_user_port everywhere")
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Claude:claude-sonnet-4-6 vscode
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
---
 drivers/net/dsa/bcm_sf2_cfp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index 84a086c3e99b..6ac5cf154f31 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -867,9 +867,9 @@ static int bcm_sf2_cfp_rule_insert(struct dsa_switch *ds, int port,
 	port_num = ring_cookie / SF2_NUM_EGRESS_QUEUES;
 
 	if (ring_cookie == RX_CLS_FLOW_DISC ||
+	    port_num >= priv->hw_params.num_ports ||
 	    !(dsa_is_user_port(ds, port_num) ||
-	      dsa_is_cpu_port(ds, port_num)) ||
-	    port_num >= priv->hw_params.num_ports)
+	      dsa_is_cpu_port(ds, port_num)))
 		return -EINVAL;
 
 	/* If the rule is matching a particular VLAN, make sure that we honor
-- 
2.54.0