Re: [PATCH v3] rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()

[Ping-Ke Shih]

pip-izony <eeodqql09@xxxxxxxxx> wrote:

> From: Seungjin Bae <eeodqql09@xxxxxxxxx>
> 
> The rtl8187_rx_cb() calculates the rx descriptor header address
> by subtracting its size from the skb tail pointer.
> However, it does not validate if the received packet
> (skb->len from urb->actual_length) is large enough to contain this
> header.
> 
> If a truncated packet is received, this will lead to a buffer
> underflow, reading memory before the start of the skb data area,
> and causing a kernel panic.
> 
> Add length checks for both rtl8187 and rtl8187b descriptor headers
> before attempting to access them, dropping the packet cleanly if the
> check fails.
> 
> Fixes: 6f7853f3cbe4 ("rtl8187: change rtl8187_dev.c to support RTL8187B (part 2)")
> Signed-off-by: Seungjin Bae <eeodqql09@xxxxxxxxx>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

b647d2574e45 wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()

---
https://github.com/pkshih/rtw.git