Felix Fietkau <nbd@xxxxxxxx> wrote: > If the hardware receives an oversized packet with too many rx fragments, > skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. > This becomes especially visible if it corrupts the freelist pointer of > a slab page. > > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Felix Fietkau <nbd@xxxxxxxx> Patch applied to wireless-drivers.git, thanks. b102f0c522cf mt76: fix array overflow on receiving too many fragments for a packet -- https://patchwork.kernel.org/patch/11393869/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
