From: Greg Kroah-Hartman Date: Tue, 9 May 2017 12:14:52 +0000 (+0200) Subject: 3.18-stable patches X-Git-Tag: v4.4.68~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=81625b100c0770d86f0390db9059587a8ad7204d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch brcmfmac-make-skb-header-writable-before-use.patch --- diff --git a/queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch b/queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch new file mode 100644 index 00000000000..6e567473a10 --- /dev/null +++ b/queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch @@ -0,0 +1,44 @@ +From 455a1eb4654c24560eb9dfc634f29cba3d87601e Mon Sep 17 00:00:00 2001 +From: James Hughes +Date: Mon, 24 Apr 2017 12:40:50 +0100 +Subject: brcmfmac: Ensure pointer correctly set if skb data location changes + +From: James Hughes + +commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream. + +The incoming skb header may be resized if header space is +insufficient, which might change the data adddress in the skb. +Ensure that a cached pointer to that data is correctly set by +moving assignment to after any possible changes. + +Signed-off-by: James Hughes +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Arend van Spriel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c +@@ -192,7 +192,7 @@ static netdev_tx_t brcmf_netdev_start_xm + int ret; + struct brcmf_if *ifp = netdev_priv(ndev); + struct brcmf_pub *drvr = ifp->drvr; +- struct ethhdr *eh = (struct ethhdr *)(skb->data); ++ struct ethhdr *eh; + + brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx); + +@@ -238,6 +238,8 @@ static netdev_tx_t brcmf_netdev_start_xm + goto done; + } + ++ eh = (struct ethhdr *)(skb->data); ++ + if (eh->h_proto == htons(ETH_P_PAE)) + atomic_inc(&ifp->pend_8021x_cnt); + diff --git a/queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch b/queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch new file mode 100644 index 00000000000..f2ad0f7cc6e --- /dev/null +++ b/queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch @@ -0,0 +1,55 @@ +From 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 Mon Sep 17 00:00:00 2001 +From: James Hughes +Date: Tue, 25 Apr 2017 10:15:06 +0100 +Subject: brcmfmac: Make skb header writable before use + +From: James Hughes + +commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream. + +The driver was making changes to the skb_header without +ensuring it was writable (i.e. uncloned). +This patch also removes some boiler plate header size +checking/adjustment code as that is also handled by the +skb_cow_header function used to make header writable. + +Signed-off-by: James Hughes +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Arend van Spriel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c +@@ -213,22 +213,13 @@ static netdev_tx_t brcmf_netdev_start_xm + goto done; + } + +- /* Make sure there's enough room for any header */ +- if (skb_headroom(skb) < drvr->hdrlen) { +- struct sk_buff *skb2; +- +- brcmf_dbg(INFO, "%s: insufficient headroom\n", ++ /* Make sure there's enough writable headroom*/ ++ ret = skb_cow_head(skb, drvr->hdrlen); ++ if (ret < 0) { ++ brcmf_err("%s: skb_cow_head failed\n", + brcmf_ifname(drvr, ifp->bssidx)); +- drvr->bus_if->tx_realloc++; +- skb2 = skb_realloc_headroom(skb, drvr->hdrlen); + dev_kfree_skb(skb); +- skb = skb2; +- if (skb == NULL) { +- brcmf_err("%s: skb_realloc_headroom failed\n", +- brcmf_ifname(drvr, ifp->bssidx)); +- ret = -ENOMEM; +- goto done; +- } ++ goto done; + } + + /* validate length for ether packet */ diff --git a/queue-3.18/series b/queue-3.18/series index 348dfe4608f..f70adf61fa7 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -27,3 +27,5 @@ usb-serial-mct_u232-fix-modem-status-error-handling.patch usb-serial-io_edgeport-fix-descriptor-error-handling.patch usb-serial-sierra-fix-bogus-alternate-setting-assumption.patch scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch +brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch +brcmfmac-make-skb-header-writable-before-use.patch