gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

mt76: usb: check urb->num_sgs limit in mt76u_process_rx_entry

Browse Source 
check nsgs value is less than urb->num_sgs in mt76u_process_rx_entry
in order to avoid an out-of-bound access of urb->sg array

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Lorenzo Bianconi
2019-02-26 12:29:12 +01:00
committed by Felix Fietkau
parent b040ef7e1c
commit 645ef43300
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
usb.c
+1 -1
View File
@@ -467,7 +467,7 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct mt76u_buf *buf)
__skb_put(skb, data_len);
len -= data_len;
while (len > 0 && urb->num_sgs) {
while (len > 0 && nsgs < urb->num_sgs) {
data_len = min_t(int, len, urb->sg[nsgs].length);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
sg_page(&urb->sg[nsgs]),