| commit | b102f0c522cf668c8382c56a4f771b37d011cda2 | [log] [tgz] |
|---|---|---|
| author | Felix Fietkau <nbd@nbd.name> | Thu Feb 20 12:41:39 2020 +0100 |
| committer | Kalle Valo <kvalo@codeaurora.org> | Tue Mar 03 17:30:25 2020 +0200 |
| tree | 7241c52d1e25587c46fe14df15ee207c0c11eeaf | |
| parent | a9149d243f259ad8f02b1e23dfe8ba06128f15e1 [diff] |
mt76: fix array overflow on receiving too many fragments for a packet If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>