Felix Fietkau b102f0c522 mt76: fix array overflow on receiving too many fragments for a packet ...

If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

2020-03-03 17:30:25 +02:00

..

admtek

adm80211: remove set but not used variables 'mem_addr' and 'io_addr'

2019-10-24 08:48:00 +03:00

ath

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2020-01-28 16:02:33 -08:00

atmel

at76c50x-usb: fix endpoint debug message

2019-12-18 21:06:02 +02:00

broadcom

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2020-01-28 16:02:33 -08:00

cisco

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

intel

iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices

2020-02-13 12:02:54 +02:00

intersil

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

marvell

libertas: make lbs_ibss_join_existing() return error code on rates overflow

2020-01-27 16:36:33 +02:00

mediatek

mt76: fix array overflow on receiving too many fragments for a packet

2020-03-03 17:30:25 +02:00

quantenna

qtnfmac: add support for TWT responder and spatial reuse

2020-01-26 17:44:02 +02:00

ralink

rt2x00usb: Fix a warning message in 'rt2x00usb_watchdog_tx_dma()'

2019-12-18 20:58:48 +02:00

realtek

rtw88: Fix return value of rtw_wow_check_fw_status

2020-02-03 20:10:31 +02:00

rsi

rsi_91x_usb: fix interface sanity check

2019-12-18 21:06:06 +02:00

st

cw1200: use true,false for bool variable

2020-01-26 17:40:43 +02:00

ti

wlcore: mesh: Add support for RX Broadcast Key

2020-01-26 17:33:40 +02:00

zydas

Merge tag 'wireless-drivers-next-2019-12-20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

2019-12-20 21:55:00 -08:00

Kconfig

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00

mac80211_hwsim.c

mac80211_hwsim: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops

2019-11-08 10:17:33 +01:00

mac80211_hwsim.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

Makefile

mac80211-next: rtnetlink wifi simulation device

2018-12-05 15:31:31 +01:00

ray_cs.c

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

ray_cs.h

…

rayctl.h

…

rndis_wlan.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13

2019-05-21 11:28:45 +02:00

virt_wifi.c

virt_wifi: fix use-after-free in virt_wifi_newlink()

2019-11-22 13:36:25 +01:00

wl3501_cs.c

netdev: pass the stuck queue to the timeout handler

2019-12-12 21:38:57 -08:00

wl3501.h

…