Re: [PATCH rtw-next] wifi: rtw88: sdio: reject oversized RX packets

[Ping-Ke Shih]

Luka Gejak <luka.gejak@xxxxxxxxx> wrote:

> rtw_sdio_rxfifo_recv() also takes the last-entry path when the descriptor
> claims more data than rx_len. The skb is then passed to rtw_sdio_rx_skb(),
> which calls skb_put() with pkt_len and does not check it against the space
> left, so a bad descriptor can overflow the skb.
> 
> Reject the packet when pkt_offset + pkt_len exceeds the bytes left.
> 
> Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Luka Gejak <luka.gejak@xxxxxxxxx>
> Acked-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

83ca360e8528 wifi: rtw88: sdio: reject oversized RX packets

---
https://github.com/pkshih/rtw.git