linux_dsm_epyc7002/drivers/net/wireless/mediatek
Felix Fietkau b102f0c522 mt76: fix array overflow on receiving too many fragments for a packet
If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2020-03-03 17:30:25 +02:00
..
mt76 mt76: fix array overflow on receiving too many fragments for a packet 2020-03-03 17:30:25 +02:00
mt7601u wireless-drivers-next patches for 5.5 2019-11-05 18:36:35 -08:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00