3.18-stable patches

added patches:
	brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
	brcmfmac-make-skb-header-writable-before-use.patch

diff --git a/queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch b/queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
new file mode 100644 (file)
index 0000000..6e56747
--- /dev/null
+++ b/queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
@@ -0,0 +1,44 @@
+From 455a1eb4654c24560eb9dfc634f29cba3d87601e Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Mon, 24 Apr 2017 12:40:50 +0100
+Subject: brcmfmac: Ensure pointer correctly set if skb data location changes
+
+From: James Hughes <james.hughes@raspberrypi.org>
+
+commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.
+
+The incoming skb header may be resized if header space is
+insufficient, which might change the data adddress in the skb.
+Ensure that a cached pointer to that data is correctly set by
+moving assignment to after any possible changes.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+@@ -192,7 +192,7 @@ static netdev_tx_t brcmf_netdev_start_xm
+       int ret;
+       struct brcmf_if *ifp = netdev_priv(ndev);
+       struct brcmf_pub *drvr = ifp->drvr;
+-      struct ethhdr *eh = (struct ethhdr *)(skb->data);
++      struct ethhdr *eh;
+ 
+       brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
+ 
+@@ -238,6 +238,8 @@ static netdev_tx_t brcmf_netdev_start_xm
+               goto done;
+       }
+ 
++      eh = (struct ethhdr *)(skb->data);
++
+       if (eh->h_proto == htons(ETH_P_PAE))
+               atomic_inc(&ifp->pend_8021x_cnt);
+ 

diff --git a/queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch b/queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch
new file mode 100644 (file)
index 0000000..f2ad0f7
--- /dev/null
+++ b/queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch
@@ -0,0 +1,55 @@
+From 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Tue, 25 Apr 2017 10:15:06 +0100
+Subject: brcmfmac: Make skb header writable before use
+
+From: James Hughes <james.hughes@raspberrypi.org>
+
+commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream.
+
+The driver was making changes to the skb_header without
+ensuring it was writable (i.e. uncloned).
+This patch also removes some boiler plate header size
+checking/adjustment code as that is also handled by the
+skb_cow_header function used to make header writable.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c |   19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+@@ -213,22 +213,13 @@ static netdev_tx_t brcmf_netdev_start_xm
+               goto done;
+       }
+ 
+-      /* Make sure there's enough room for any header */
+-      if (skb_headroom(skb) < drvr->hdrlen) {
+-              struct sk_buff *skb2;
+-
+-              brcmf_dbg(INFO, "%s: insufficient headroom\n",
++      /* Make sure there's enough writable headroom*/
++      ret = skb_cow_head(skb, drvr->hdrlen);
++      if (ret < 0) {
++              brcmf_err("%s: skb_cow_head failed\n",
+                         brcmf_ifname(drvr, ifp->bssidx));
+-              drvr->bus_if->tx_realloc++;
+-              skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
+               dev_kfree_skb(skb);
+-              skb = skb2;
+-              if (skb == NULL) {
+-                      brcmf_err("%s: skb_realloc_headroom failed\n",
+-                                brcmf_ifname(drvr, ifp->bssidx));
+-                      ret = -ENOMEM;
+-                      goto done;
+-              }
++              goto done;
+       }
+ 
+       /* validate length for ether packet */

diff --git a/queue-3.18/series b/queue-3.18/series
index 348dfe4608fbd78eedd6b1e767e80d6d1ae93be3..f70adf61fa7f156f140eae6f46ec845596f4bcde 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -27,3 +27,5 @@ usb-serial-mct_u232-fix-modem-status-error-handling.patch
 usb-serial-io_edgeport-fix-descriptor-error-handling.patch
 usb-serial-sierra-fix-bogus-alternate-setting-assumption.patch
 scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch
+brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
+brcmfmac-make-skb-header-writable-before-use.patch