Nickolay SavchenkoandJonas Jelonek
364b4c0d24
fe_poll_rx() takes the packet length directly from the RX descriptor and passes it to skb_put() without checking that it fits in the allocated buffer. A malformed or stale descriptor can therefore extend the skb beyond its tailroom and corrupt memory. Reject lengths larger than skb_tailroom(), account the packet in rx_length_errors and rx_dropped, free the affected skb, and continue by installing the replacement descriptor. Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv> Link: https://github.com/openwrt/openwrt/pull/24268 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>