diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
index e2bf16f..574440d 100755
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
@@ -1220,12 +1220,11 @@
 	char *p_token = NULL;
 	char *p_delimiter = " \t";
 	long x = 0, y = 0;
-	int len = count;
+	u32 len = count;
 	int ret;
 
 	if (len >= sizeof(buf)) {
 		pr_info("Input handling fail!\n");
-		len = sizeof(buf) - 1;
 		return -1;
 	}
 
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index d204cc8..658f1ab 100755
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -3393,6 +3393,8 @@
 	if(eth->soc->has_sram) {
 		struct resource *res;
 		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+		if (unlikely(!res))
+			return -EINVAL;
 		eth->phy_scratch_ring = res->start + MTK_ETH_SRAM_OFFSET;
 	}
 
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c
index 5646a3a..c10e7ed 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c
@@ -285,12 +285,15 @@
 	pr_info("hnat roaming work disable\n");
 }
 
-static int hnat_start(int ppe_id)
+static int hnat_start(u32 ppe_id)
 {
 	u32 foe_table_sz;
 	u32 foe_mib_tb_sz;
 	int etry_num_cfg;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	/* mapp the FOE table */
 	for (etry_num_cfg = DEF_ETRY_NUM_CFG ; etry_num_cfg >= 0 ; etry_num_cfg--, hnat_priv->foe_etry_num /= 2) {
 		foe_table_sz = hnat_priv->foe_etry_num * sizeof(struct foe_entry);
@@ -409,11 +412,14 @@
 	return 0;
 }
 
-static int ppe_busy_wait(int ppe_id)
+static int ppe_busy_wait(u32 ppe_id)
 {
 	unsigned long t_start = jiffies;
 	u32 r = 0;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	while (1) {
 		r = readl((hnat_priv->ppe_base[ppe_id] + 0x0));
 		if (!(r & BIT(31)))
@@ -428,13 +434,16 @@
 	return -1;
 }
 
-static void hnat_stop(int ppe_id)
+static void hnat_stop(u32 ppe_id)
 {
 	u32 foe_table_sz;
 	u32 foe_mib_tb_sz;
 	struct foe_entry *entry, *end;
 	u32 r1 = 0, r2 = 0;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return;
+
 	/* send all traffic back to the DMA engine */
 	set_gmac_ppe_fwd(0, 0);
 	set_gmac_ppe_fwd(1, 0);
@@ -617,6 +626,9 @@
 	hnat_priv->foe_etry_num = DEF_ETRY_NUM;
 
 	match = of_match_device(of_hnat_match, &pdev->dev);
+	if (unlikely(!match))
+		return -EINVAL;
+
 	hnat_priv->data = (struct mtk_hnat_data *)match->data;
 
 	hnat_priv->dev = &pdev->dev;
@@ -626,21 +638,21 @@
 	if (err < 0)
 		return -EINVAL;
 
-	strncpy(hnat_priv->wan, (char *)name, IFNAMSIZ);
+	strncpy(hnat_priv->wan, (char *)name, IFNAMSIZ - 1);
 	dev_info(&pdev->dev, "wan = %s\n", hnat_priv->wan);
 
 	err = of_property_read_string(np, "mtketh-lan", &name);
 	if (err < 0)
 		strncpy(hnat_priv->lan, "eth0", IFNAMSIZ);
 	else
-		strncpy(hnat_priv->lan, (char *)name, IFNAMSIZ);
+		strncpy(hnat_priv->lan, (char *)name, IFNAMSIZ - 1);
 	dev_info(&pdev->dev, "lan = %s\n", hnat_priv->lan);
 
 	err = of_property_read_string(np, "mtketh-ppd", &name);
 	if (err < 0)
 		strncpy(hnat_priv->ppd, "eth0", IFNAMSIZ);
 	else
-		strncpy(hnat_priv->ppd, (char *)name, IFNAMSIZ);
+		strncpy(hnat_priv->ppd, (char *)name, IFNAMSIZ - 1);
 	dev_info(&pdev->dev, "ppd = %s\n", hnat_priv->ppd);
 
 	/*get total gmac num in hnat*/
@@ -701,7 +713,7 @@
 			err = -ENOMEM;
 			goto err_out1;
 		}
-		strncpy(ext_entry->name, (char *)name, IFNAMSIZ);
+		strncpy(ext_entry->name, (char *)name, IFNAMSIZ - 1);
 		ext_if_add(ext_entry);
 	}
 
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.h b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.h
index 19482e5..ce5af47 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.h
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.h
@@ -941,10 +941,10 @@
 int hnat_disable_hook(void);
 void hnat_cache_ebl(int enable);
 void set_gmac_ppe_fwd(int gmac_no, int enable);
-int entry_detail(int ppe_id, int index);
+int entry_detail(u32 ppe_id, int index);
 int entry_delete_by_mac(u8 *mac);
-int entry_delete(int ppe_id, int index);
-struct hnat_accounting *hnat_get_count(struct mtk_hnat *h, int ppe_id,
+int entry_delete(u32 ppe_id, int index);
+struct hnat_accounting *hnat_get_count(struct mtk_hnat *h, u32 ppe_id,
 				       u32 index, struct hnat_accounting *diff);
 
 static inline u16 foe_timestamp(struct mtk_hnat *h)
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c
index 4b9006a..4a95c10 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c
@@ -332,7 +332,7 @@
 	return 0;
 }
 
-int entry_detail(int ppe_id, int index)
+int entry_detail(u32 ppe_id, int index)
 {
 	struct foe_entry *entry;
 	struct mtk_hnat *h = hnat_priv;
@@ -525,7 +525,7 @@
 	return 0;
 }
 
-int entry_delete(int ppe_id, int index)
+int entry_delete(u32 ppe_id, int index)
 {
 	struct foe_entry *entry;
 	struct mtk_hnat *h = hnat_priv;
@@ -703,11 +703,15 @@
 	[6] = udp_keep_alive,    [7] = set_nf_update_toggle,
 };
 
-int read_mib(struct mtk_hnat *h, int ppe_id,
+int read_mib(struct mtk_hnat *h, u32 ppe_id,
 	     u32 index, u64 *bytes, u64 *packets)
 {
 	int ret;
 	u32 val, cnt_r0, cnt_r1, cnt_r2;
+
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	writel(index | (1 << 16), h->ppe_base[ppe_id] + PPE_MIB_SER_CR);
 	ret = readx_poll_timeout_atomic(readl, h->ppe_base[ppe_id] + PPE_MIB_SER_CR, val,
 					!(val & BIT_MIB_BUSY), 20, 10000);
@@ -726,12 +730,15 @@
 
 }
 
-struct hnat_accounting *hnat_get_count(struct mtk_hnat *h, int ppe_id,
+struct hnat_accounting *hnat_get_count(struct mtk_hnat *h, u32 ppe_id,
 				       u32 index, struct hnat_accounting *diff)
 
 {
 	u64 bytes, packets;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return NULL;
+
 	if (!hnat_priv->data->per_flow_accounting)
 		return NULL;
 
@@ -753,7 +760,7 @@
 #define PRINT_COUNT(m, acct) {if (acct) \
 		seq_printf(m, "bytes=%llu|packets=%llu|", \
 			   acct->bytes, acct->packets); }
-static int __hnat_debug_show(struct seq_file *m, void *private, int ppe_id)
+static int __hnat_debug_show(struct seq_file *m, void *private, u32 ppe_id)
 {
 	struct mtk_hnat *h = hnat_priv;
 	struct foe_entry *entry, *end;
@@ -762,6 +769,9 @@
 	struct hnat_accounting *acct;
 	u32 entry_index = 0;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	entry = h->foe_table_cpu[ppe_id];
 	end = h->foe_table_cpu[ppe_id] + hnat_priv->foe_etry_num;
 	while (entry < end) {
@@ -1092,7 +1102,7 @@
 {
 	char buf[32];
 	char *p_buf;
-	int len = count;
+	u32 len = count;
 	long arg0 = 0, arg1 = 0;
 	char *p_token = NULL;
 	char *p_delimiter = " \t";
@@ -1100,7 +1110,6 @@
 
 	if (len >= sizeof(buf)) {
 		pr_info("input handling fail!\n");
-		len = sizeof(buf) - 1;
 		return -1;
 	}
 
@@ -1237,13 +1246,16 @@
 	}
 }
 
-int __hnat_entry_read(struct seq_file *m, void *private, int ppe_id)
+int __hnat_entry_read(struct seq_file *m, void *private, u32 ppe_id)
 {
 	struct mtk_hnat *h = hnat_priv;
 	struct foe_entry *entry, *end;
 	int hash_index;
 	int cnt;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	hash_index = 0;
 	cnt = 0;
 	entry = h->foe_table_cpu[ppe_id];
@@ -1286,7 +1298,7 @@
 {
 	char buf[32];
 	char *p_buf;
-	int len = count;
+	u32 len = count;
 	long arg0 = 0, arg1 = 0;
 	char *p_token = NULL;
 	char *p_delimiter = " \t";
@@ -1294,7 +1306,6 @@
 
 	if (len >= sizeof(buf)) {
 		pr_info("input handling fail!\n");
-		len = sizeof(buf) - 1;
 		return -1;
 	}
 
@@ -1348,12 +1359,15 @@
 	.release = single_release,
 };
 
-int __hnat_setting_read(struct seq_file *m, void *private, int ppe_id)
+int __hnat_setting_read(struct seq_file *m, void *private, u32 ppe_id)
 {
 	struct mtk_hnat *h = hnat_priv;
 	int i;
 	int cr_max;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	cr_max = 319 * 4;
 	for (i = 0; i < cr_max; i = i + 0x10) {
 		pr_info("0x%p : 0x%08x 0x%08x 0x%08x 0x%08x\n",
@@ -1387,7 +1401,7 @@
 {
 	char buf[32];
 	char *p_buf;
-	int len = count;
+	u32 len = count;
 	long arg0 = 0, arg1 = 0;
 	char *p_token = NULL;
 	char *p_delimiter = " \t";
@@ -1395,7 +1409,6 @@
 
 	if (len >= sizeof(buf)) {
 		pr_info("input handling fail!\n");
-		len = sizeof(buf) - 1;
 		return -1;
 	}
 
@@ -1446,7 +1459,7 @@
 	.release = single_release,
 };
 
-int __mcast_table_dump(struct seq_file *m, void *private, int ppe_id)
+int __mcast_table_dump(struct seq_file *m, void *private, u32 ppe_id)
 {
 	struct mtk_hnat *h = hnat_priv;
 	struct ppe_mcast_h mcast_h;
@@ -1454,6 +1467,9 @@
 	u8 i, max;
 	void __iomem *reg;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	if (!h->pmcast)
 		return 0;
 
@@ -1607,7 +1623,7 @@
 {
 	long id = (long)file->private_data;
 	struct mtk_hnat *h = hnat_priv;
-	char line[64];
+	char line[64] = {0};
 	int enable, rate, exp = 0, shift = 0;
 	char scheduling[32];
 	size_t size;
@@ -1751,7 +1767,7 @@
 {
 	long id = (long)file->private_data;
 	struct mtk_hnat *h = hnat_priv;
-	char line[64];
+	char line[64] = {0};
 	int max_enable, max_rate, max_exp = 0;
 	int min_enable, min_rate, min_exp = 0;
 	int weight;
@@ -1842,7 +1858,7 @@
 			dev_put(hnat_priv->g_ppdev);
 		hnat_priv->g_ppdev = dev;
 
-		strncpy(hnat_priv->ppd, p, IFNAMSIZ);
+		strncpy(hnat_priv->ppd, p, IFNAMSIZ - 1);
 		pr_info("hnat_priv ppd = %s\n", hnat_priv->ppd);
 	} else {
 		pr_info("no such device!\n");
@@ -1893,7 +1909,7 @@
 static ssize_t hnat_mape_toggle_write(struct file *file, const char __user *buffer,
 				      size_t count, loff_t *data)
 {
-	char buf;
+	char buf = 0;
 	int len = count;
 
 	if (copy_from_user(&buf, buffer, len))
@@ -1933,7 +1949,7 @@
 static ssize_t hnat_hook_toggle_write(struct file *file, const char __user *buffer,
 				      size_t count, loff_t *data)
 {
-	char buf[8];
+	char buf[8] = {0};
 	int len = count;
 
 	if ((len > 8) || copy_from_user(buf, buffer, len))
@@ -2020,14 +2036,14 @@
 	.release = single_release,
 };
 
-int get_ppe_mib(int ppe_id, int index, u64 *pkt_cnt, u64 *byte_cnt)
+int get_ppe_mib(u32 ppe_id, int index, u64 *pkt_cnt, u64 *byte_cnt)
 {
 	struct mtk_hnat *h = hnat_priv;
 	struct hnat_accounting *acct;
 	struct foe_entry *entry;
 
 	if (ppe_id >= CFG_PPE_NUM)
-		return -1;
+		return -EINVAL;
 
 	if (index < 0 || index >= h->foe_etry_num) {
 		pr_info("Invalid entry index\n");
@@ -2050,13 +2066,13 @@
 }
 EXPORT_SYMBOL(get_ppe_mib);
 
-int is_entry_binding(int ppe_id, int index)
+int is_entry_binding(u32 ppe_id, int index)
 {
 	struct mtk_hnat *h = hnat_priv;
 	struct foe_entry *entry;
 
 	if (ppe_id >= CFG_PPE_NUM)
-		return -1;
+		return -EINVAL;
 
 	if (index < 0 || index >= h->foe_etry_num) {
 		pr_info("Invalid entry index\n");
@@ -2192,7 +2208,11 @@
 
 void hnat_deinit_debugfs(struct mtk_hnat *h)
 {
+	int i;
+
 	debugfs_remove_recursive(h->root);
 	h->root = NULL;
-	kfree(h->regset);
+
+	for (i = 0; i < CFG_PPE_NUM; i++)
+		kfree(h->regset[i]);
 }
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c
index d11dfcd..512c845 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c
@@ -61,7 +61,7 @@
 }
 
 /*set_hnat_mtbl - set ppe multicast register*/
-static int set_hnat_mtbl(struct ppe_mcast_group *group, int ppe_id, int index)
+static int set_hnat_mtbl(struct ppe_mcast_group *group, u32 ppe_id, int index)
 {
 	struct ppe_mcast_h mcast_h;
 	struct ppe_mcast_l mcast_l;
@@ -70,6 +70,9 @@
 	u8 mc_port = group->mc_port;
 	void __iomem *reg;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	mcast_h.u.value = 0;
 	mcast_l.addr = 0;
 	if (mac_lo == 0x0100)
@@ -110,8 +113,8 @@
 static int hnat_mcast_table_update(int type, struct br_mdb_entry *entry)
 {
 	struct net_device *dev;
-	u32 mac_hi;
-	u16 mac_lo;
+	u32 mac_hi = 0;
+	u16 mac_lo = 0;
 	int i, index;
 	struct ppe_mcast_group *group;
 
@@ -275,13 +278,16 @@
 	mod_timer(&hnat_priv->hnat_mcast_check_timer, jiffies + 10 * HZ);
 }
 
-int hnat_mcast_enable(int ppe_id)
+int hnat_mcast_enable(u32 ppe_id)
 {
 	struct ppe_mcast_table *pmcast;
 
+	if (ppe_id >= CFG_PPE_NUM)
+		return -EINVAL;
+
 	pmcast = kzalloc(sizeof(*pmcast), GFP_KERNEL);
 	if (!pmcast)
-		goto err;
+		return -1;
 
 	if (hnat_priv->data->version == MTK_HNAT_V1)
 		pmcast->max_entry = 0x10;
@@ -332,19 +338,17 @@
 int hnat_mcast_disable(void)
 {
 	struct ppe_mcast_table *pmcast = hnat_priv->pmcast;
-	struct socket *sock = pmcast->msock;
-	struct workqueue_struct *queue = pmcast->queue;
-	struct work_struct *work = &pmcast->work;
+
+	if (!pmcast)
+		return -EINVAL;
 
 	if (hnat_priv->data->version == MTK_HNAT_V3)
 		del_timer_sync(&hnat_priv->hnat_mcast_check_timer);
 
-	if (pmcast) {
-		flush_work(work);
-		destroy_workqueue(queue);
-		sock_release(sock);
-		kfree(pmcast);
-	}
+	flush_work(&pmcast->work);
+	destroy_workqueue(pmcast->queue);
+	sock_release(pmcast->msock);
+	kfree(pmcast);
 
 	return 0;
 }
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.h b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.h
index f6993a5..ad5b5d1 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.h
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.h
@@ -63,7 +63,7 @@
 	u32 addr;
 };
 
-int hnat_mcast_enable(int ppe_id);
+int hnat_mcast_enable(u32 ppe_id);
 int hnat_mcast_disable(void);
 
 #endif
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
index c36ee98..fe81bf3 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
@@ -161,7 +161,9 @@
 {
 	int len = get_ext_device_number();
 
-	hnat_priv->ext_if[len++] = ext_entry;
+	if (len < MAX_EXT_DEVS)
+		hnat_priv->ext_if[len++] = ext_entry;
+
 	return len;
 }
 
@@ -611,6 +613,9 @@
 	/* WAN -> LAN/WLAN MapE. */
 	if (mape_toggle && (ip6h->nexthdr == NEXTHDR_IPIP)) {
 		iph = skb_header_pointer(skb, IPV6_HDR_LEN, sizeof(_iphdr), &_iphdr);
+		if (unlikely(!iph))
+			return -1;
+
 		switch (iph->protocol) {
 		case IPPROTO_UDP:
 		case IPPROTO_TCP:
@@ -682,6 +687,8 @@
 		} else if (ip6h->nexthdr == NEXTHDR_IPIP) {
 			iph = skb_header_pointer(skb, IPV6_HDR_LEN,
 						 sizeof(_iphdr), &_iphdr);
+			if (unlikely(!iph))
+				return 0;
 
 			if ((iph->protocol == IPPROTO_TCP) ||
 			    (iph->protocol == IPPROTO_UDP)) {
@@ -1139,6 +1146,8 @@
 								  iph->ihl * 4,
 								  sizeof(_ports),
 								  &_ports);
+					if (unlikely(!pptr))
+						return -1;
 
 					entry.ipv4_dslite.new_sip =
 							ntohl(iph->saddr);
@@ -1205,6 +1214,9 @@
 				pptr = skb_header_pointer(skb, iph->ihl * 4,
 							  sizeof(_ports),
 							  &_ports);
+				if (unlikely(!pptr))
+					return -1;
+
 				entry.ipv4_hnapt.new_sport = ntohs(pptr->src);
 				entry.ipv4_hnapt.new_dport = ntohs(pptr->dst);
 			}
@@ -1384,7 +1396,6 @@
 		break;
 
 	default:
-		ip6h = ipv6_hdr(skb);
 		iph = ip_hdr(skb);
 		switch (entry.bfib1.pkt_type) {
 		case IPV6_6RD: /* 6RD LAN->WAN */
@@ -1800,7 +1811,7 @@
 			if (!ext_entry)
 				return;
 
-			strncpy(ext_entry->name, dev->name, IFNAMSIZ);
+			strncpy(ext_entry->name, dev->name, IFNAMSIZ - 1);
 			dev_hold(dev);
 			ext_entry->dev = dev;
 			ext_if_add(ext_entry);
@@ -2011,6 +2022,9 @@
 			if (mape_toggle) {
 				iph = skb_header_pointer(skb, IPV6_HDR_LEN,
 							 sizeof(_iphdr), &_iphdr);
+				if (unlikely(!iph))
+					return NF_ACCEPT;
+
 				switch (iph->protocol) {
 				case IPPROTO_UDP:
 					udp = 1;
@@ -2023,6 +2037,9 @@
 
 				pptr = skb_header_pointer(skb, IPV6_HDR_LEN + iph->ihl * 4,
 							  sizeof(_ports), &_ports);
+				if (unlikely(!pptr))
+                                        return NF_ACCEPT;
+
 				entry->bfib1.udp = udp;
 
 #if defined(CONFIG_MEDIATEK_NETSYS_V2)
@@ -2268,9 +2285,6 @@
 	struct nf_hook_ops *hook = mtk_hnat_nf_ops;
 	unsigned int n = ARRAY_SIZE(mtk_hnat_nf_ops);
 
-	if (!hook)
-		return -1;
-
 	while (n-- > 0) {
 		if (hook[n].hook == mtk_hnat_br_nf_local_in) {
 			hook[n].hooknum = NF_BR_PRE_ROUTING;
diff --git a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_stag.c b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_stag.c
index aa40d99..6e96429 100644
--- a/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_stag.c
+++ b/target/linux/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_stag.c
@@ -25,6 +25,9 @@
 		ndev = netdev;
 
 	port_reg = of_get_property(ndev->dev.of_node, "reg", NULL);
+	if (unlikely(!port_reg))
+		return;
+
 	port_index = be32_to_cpup(port_reg);
 	sp_tag = BIT(port_index);