4.4-stable patches

added patches:
	brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
	brcmfmac-make-skb-header-writable-before-use.patch

diff --git a/queue-4.4/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch b/queue-4.4/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
new file mode 100644 (file)
index 0000000..693b84a
--- /dev/null
+++ b/queue-4.4/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
@@ -0,0 +1,44 @@
+From 455a1eb4654c24560eb9dfc634f29cba3d87601e Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Mon, 24 Apr 2017 12:40:50 +0100
+Subject: brcmfmac: Ensure pointer correctly set if skb data location changes
+
+From: James Hughes <james.hughes@raspberrypi.org>
+
+commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.
+
+The incoming skb header may be resized if header space is
+insufficient, which might change the data adddress in the skb.
+Ensure that a cached pointer to that data is correctly set by
+moving assignment to after any possible changes.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/core.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
+@@ -211,7 +211,7 @@ static netdev_tx_t brcmf_netdev_start_xm
+       int ret;
+       struct brcmf_if *ifp = netdev_priv(ndev);
+       struct brcmf_pub *drvr = ifp->drvr;
+-      struct ethhdr *eh = (struct ethhdr *)(skb->data);
++      struct ethhdr *eh;
+ 
+       brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
+ 
+@@ -257,6 +257,8 @@ static netdev_tx_t brcmf_netdev_start_xm
+               goto done;
+       }
+ 
++      eh = (struct ethhdr *)(skb->data);
++
+       if (eh->h_proto == htons(ETH_P_PAE))
+               atomic_inc(&ifp->pend_8021x_cnt);
+ 

diff --git a/queue-4.4/brcmfmac-make-skb-header-writable-before-use.patch b/queue-4.4/brcmfmac-make-skb-header-writable-before-use.patch
new file mode 100644 (file)
index 0000000..b0f9551
--- /dev/null
+++ b/queue-4.4/brcmfmac-make-skb-header-writable-before-use.patch
@@ -0,0 +1,55 @@
+From 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 Mon Sep 17 00:00:00 2001
+From: James Hughes <james.hughes@raspberrypi.org>
+Date: Tue, 25 Apr 2017 10:15:06 +0100
+Subject: brcmfmac: Make skb header writable before use
+
+From: James Hughes <james.hughes@raspberrypi.org>
+
+commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream.
+
+The driver was making changes to the skb_header without
+ensuring it was writable (i.e. uncloned).
+This patch also removes some boiler plate header size
+checking/adjustment code as that is also handled by the
+skb_cow_header function used to make header writable.
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/core.c |   19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
+@@ -232,22 +232,13 @@ static netdev_tx_t brcmf_netdev_start_xm
+               goto done;
+       }
+ 
+-      /* Make sure there's enough room for any header */
+-      if (skb_headroom(skb) < drvr->hdrlen) {
+-              struct sk_buff *skb2;
+-
+-              brcmf_dbg(INFO, "%s: insufficient headroom\n",
++      /* Make sure there's enough writable headroom*/
++      ret = skb_cow_head(skb, drvr->hdrlen);
++      if (ret < 0) {
++              brcmf_err("%s: skb_cow_head failed\n",
+                         brcmf_ifname(drvr, ifp->bssidx));
+-              drvr->bus_if->tx_realloc++;
+-              skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
+               dev_kfree_skb(skb);
+-              skb = skb2;
+-              if (skb == NULL) {
+-                      brcmf_err("%s: skb_realloc_headroom failed\n",
+-                                brcmf_ifname(drvr, ifp->bssidx));
+-                      ret = -ENOMEM;
+-                      goto done;
+-              }
++              goto done;
+       }
+ 
+       /* validate length for ether packet */

diff --git a/queue-4.4/series b/queue-4.4/series
index 70cd44b0537d388c3f98f9180047a39e6b081e37..c6eb05ac6b85b22ee975f9587e6fe32c1471f636 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -41,3 +41,5 @@ serial-8250_omap-fix-probe-and-remove-for-pm-runtime.patch
 scsi-mac_scsi-fix-mac_scsi-m-option-when-scsi-m.patch
 scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch
 mips-r2-on-r6-multu-maddu-msubu-emulation-bugfix.patch
+brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch
+brcmfmac-make-skb-header-writable-before-use.patch