Felix Fietkau 8f8e9161b3 mt76: fix array overflow on receiving too many fragments for a packet
If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: [email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2020-02-19 13:55:52 +01:00
2015-12-13 17:54:16 +01:00
2019-12-14 18:16:08 +01:00
2020-02-14 10:16:16 +01:00
2020-02-14 10:16:16 +01:00
2019-08-22 09:26:30 +02:00
2020-02-14 10:16:16 +01:00
S
Description
mac80211 driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, MT7628 and MT7688
BSD-3-Clause
105 MiB
Languages
C 99.7%
Perl 0.2%
Makefile 0.1%