rtl8180_handle_rx() passes the 12-bit length field from the RX
descriptor to skb_put() without clamping it to MAX_RX_SIZE.  The skb was
allocated with dev_alloc_skb(MAX_RX_SIZE), so a descriptor length above
MAX_RX_SIZE extends the skb past its allocated tailroom.

Drop such frames before allocating the replacement RX skb.

Signed-off-by: Jiaxin Li <18135327133@163.com>
---
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
index 4a5989172..abd76741b 100644
--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
@@ -255,7 +255,12 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 			goto done;
 		else {
 			struct ieee80211_rx_status rx_status = {0};
-			struct sk_buff *new_skb = dev_alloc_skb(MAX_RX_SIZE);
+			struct sk_buff *new_skb;
+
+			if (unlikely((flags & 0xFFF) > MAX_RX_SIZE))
+				goto done;
+
+			new_skb = dev_alloc_skb(MAX_RX_SIZE);
 
 			if (unlikely(!new_skb))
 				goto done;

-- 
2.34.1