The DMA receive path reads header->size from the RX buffer and uses it
to extend the skb with skb_put(skb, size + sizeof(*header)). RX DMA skbs
are allocated with RX_DMA_SIZE bytes, but the DMA path did not check
that the device-provided size fits in that buffer. The MMIO path already
has a similar size check against card->buffer_size.

Reject an oversized DMA receive item before skb_put() and drop the
invalid skb, then continue through the normal DMA RX refill path so the
port is not left without a replacement receive buffer.

Signed-off-by: Pengpeng Hou <redacted>
---

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c

@@ -784,6 +784,12 @@
 
 				header = (void *)skb->data;
 				size = le16_to_cpu(header->size);
+				if (size > RX_DMA_SIZE - sizeof(*header)) {
+					dev_warn(&card->dev->dev, "Invalid DMA buffer size\n");
+					dev_kfree_skb_any(skb);
+					goto refill_rx;
+				}
+
 				skb_put(skb, size + sizeof(*header));
 				skb_pull(skb, sizeof(*header));
 			} else {

@@ -865,6 +871,7 @@
 				break;
 			}
 		}
+refill_rx:
 		/* Allocate RX skbs for any ports which need them */
 		if (card->using_dma && card->atmdev[port] &&
 		    !card->rx_skb[port]) {