Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org E8CEBC43383
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH 5.6] mt76: fix array overflow on receiving too many
 fragments for a packet
From:   Kalle Valo <kvalo@codeaurora.org>
In-Reply-To: <20200220114139.46508-1-nbd@nbd.name>
References: <20200220114139.46508-1-nbd@nbd.name>
To:     Felix Fietkau <nbd@nbd.name>
Cc:     linux-wireless@vger.kernel.org, stable@vger.kernel.org
User-Agent: pwcli/0.0.0-git (https://github.com/kvalo/pwcli/) Python/2.7.12
Message-Id: <20200303153048.15991C4479D@smtp.codeaurora.org>
Date:   Tue,  3 Mar 2020 15:30:48 +0000 (UTC)
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Felix Fietkau <nbd@nbd.name> wrote:

> If the hardware receives an oversized packet with too many rx fragments,
> skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
> This becomes especially visible if it corrupts the freelist pointer of
> a slab page.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Felix Fietkau <nbd@nbd.name>

Patch applied to wireless-drivers.git, thanks.

b102f0c522cf mt76: fix array overflow on receiving too many fragments for a packet

-- 
https://patchwork.kernel.org/patch/11393869/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches