Re: [PATCH 1/1] ionic: fix array overflow on receiving too many fragments for a packet

2020-12-06 Thread Shannon Nelson
On 12/6/20 5:51 PM, Jesse Brandeburg wrote: Xiaohui Zhang wrote: From: Zhang Xiaohui If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist

Re: [PATCH 1/1] ionic: fix array overflow on receiving too many fragments for a packet

2020-12-06 Thread Jesse Brandeburg
Xiaohui Zhang wrote: > From: Zhang Xiaohui > > If the hardware receives an oversized packet with too many rx fragments, > skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. > This becomes especially visible if it corrupts the freelist pointer of > a slab page. > >

[PATCH 1/1] ionic: fix array overflow on receiving too many fragments for a packet

2020-12-06 Thread Xiaohui Zhang
From: Zhang Xiaohui If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page. Signed-off-by: Zhang Xiaohui ---