From 30f5f2182d562b60c35df6483c92c1bf62ed0ec8 Mon Sep 17 00:00:00 2001 From: Qiujun Huang Date: Thu, 26 Mar 2020 10:14:12 +0800 Subject: [PATCH 2/2] staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312),so skblen can't be more than that. Signed-off-by: Qiujun Huang --- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ 1 file changed, 2 insertions(+) mode change 100644 => 100755 drivers/staging/wlan-ng/hfa384x_usb.c diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c old mode 100644 new mode 100755 index b71756ab0394..7fe64fcd385d --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3372,6 +3372,8 @@ static void hfa384x_int_rxmonitor(struct wlandevice *wlandev, WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { pr_debug("overlen frm: len=%zd\n", skblen - sizeof(struct p80211_caphdr)); + + return; } skb = dev_alloc_skb(skblen); -- 2.17.1