[PATCH v2] wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE

[Jiaxin Li <18135327133@163.com>]

rtl8180_handle_rx() passes the 12-bit length field from the RX
descriptor to skb_put() without clamping it to MAX_RX_SIZE.  The skb was
allocated with dev_alloc_skb(MAX_RX_SIZE), so a descriptor length above
MAX_RX_SIZE extends the skb past its allocated tailroom.

Store the reported length in a local variable and drop the frame before
allocating the replacement RX skb when it exceeds MAX_RX_SIZE.

Signed-off-by: Jiaxin Li <18135327133@163.com>
---
Changes in v2:
- Store the descriptor length in rx_len and reuse it in skb_put(),
  as suggested in review.

 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
index 4a5989172..24e96b356 100644
--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
@@ -255,7 +255,13 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 			goto done;
 		else {
 			struct ieee80211_rx_status rx_status = {0};
-			struct sk_buff *new_skb = dev_alloc_skb(MAX_RX_SIZE);
+			struct sk_buff *new_skb;
+			u32 rx_len = flags & 0xFFF;
+
+			if (unlikely(rx_len > MAX_RX_SIZE))
+				goto done;
+
+			new_skb = dev_alloc_skb(MAX_RX_SIZE);
 
 			if (unlikely(!new_skb))
 				goto done;
@@ -274,7 +280,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 			dma_unmap_single(&priv->pdev->dev,
 					 *((dma_addr_t *)skb->cb),
 					 MAX_RX_SIZE, DMA_FROM_DEVICE);
-			skb_put(skb, flags & 0xFFF);
+			skb_put(skb, rx_len);
 
 			rx_status.antenna = (flags2 >> 15) & 1;
 			rx_status.rate_idx = (flags >> 20) & 0xF;
-- 
2.34.1