gitops/mt76
1
0
Fork 0
mirror of https://github.com/outbackdingo/mt76.git synced 2026-10-24 13:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

mt76: fix array overflow on receiving too many fragments for a packet

Browse Source 
If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: [email protected]
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2020-02-19 13:55:52 +01:00
parent 284e9fd729
commit 8f8e9161b3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dma.c
+6 -3
View File
@@ -467,10 +467,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
struct page *page = virt_to_head_page(data); struct page *page = virt_to_head_page(data);
int offset = data - page_address(page); int offset = data - page_address(page);
struct sk_buff *skb = q->rx_head; struct sk_buff *skb = q->rx_head;
struct skb_shared_info *shinfo = skb_shinfo(skb);
offset += q->buf_offset; if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len, offset += q->buf_offset;
q->buf_size); skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
q->buf_size);
}
if (more) if (more)
return; return;