Commit 60e453a940ac ("USBNET: fix handling padding packet") added an extra SG entry in case padding is necessary, but failed to update the initialisation of the list. This can cause list traversal to fall off the end of the list, resulting in an oops.
Unified · Split
| @@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb) · 1244 unmodified lines | ||
| 1245 | 1245 | return -ENOMEM; |
| 1246 | 1246 | |
| 1247 | 1247 | urb->num_sgs = num_sgs; |
| 1248 | − sg_init_table(urb->sg, urb->num_sgs); | |
| 1248 | + sg_init_table(urb->sg, urb->num_sgs + 1); | |
| 1249 | 1249 | |
| 1250 | 1250 | sg_set_buf(&urb->sg[s++], skb->data, skb_headlen(skb)); |
| 1251 | 1251 | total_len += skb_headlen(skb); |