On Thu, 29 Dec 2022 18:29:06 +0900 Jisoo Jang wrote: > Fix an integer underflow that leads to a null pointer dereference in > 'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet > could be manipulated, which could trigger an integer underflow of > 'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently > causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be > bypassed, eventually leading to a dereference of the pointer 'p', which > is a null pointer. > > Ensure that 'dma_len' is greater than 'min_seg_len'. Acked-by: Jakub Kicinski <kuba@xxxxxxxxxx>
