mt76: fix array overflow on receiving too many fragments for a packet (b102f0c5) · Commits · 戴 / test

If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page. Cc: stable@vger.kernel.org Signed-off-by:

Felix Fietkau <nbd@nbd.name> Signed-off-by:

Kalle Valo <kvalo@codeaurora.org>

drivers/net/wireless/mediatek/mt76/dma.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -447,10 +447,13 @@ mt76_add_fragment(struct mt76_dev dev, struct mt76_queue q, void *data,
		struct page *page = virt_to_head_page(data);
		int offset = data - page_address(page);
		struct sk_buff *skb = q->rx_head;
		struct skb_shared_info *shinfo = skb_shinfo(skb);

		if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
		offset += q->buf_offset;
		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len,
		skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
		q->buf_size);
		}

		if (more)
		return;

Admin message