]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 419b316) | patch
mt76: fix array overflow on receiving too many fragments for a packet
authorFelix Fietkau <nbd@nbd.name>
Thu, 20 Feb 2020 11:41:39 +0000 (12:41 +0100)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 3 Mar 2020 15:30:25 +0000 (17:30 +0200)
commit0a3b12ae07fe39fd3b0be9d967c52924398ab6a9
tree7241c52d1e25587c46fe14df15ee207c0c11eeaftree | snapshot
parent419b316df7baebb2067849a5f0714294e55d91ddcommit | diff
mt76: fix array overflow on receiving too many fragments for a packet

If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/mediatek/mt76/dma.c diff | blob | history
Linux Kernel Source Tree.