Re: [PATCH 5.6] mt76: fix array overflow on receiving too many fragments for a packet

Felix Fietkau nbd@nbd.name wrote:

If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page.

Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name

Patch applied to wireless-drivers.git, thanks.

b102f0c522cf mt76: fix array overflow on receiving too many fragments for a packet