From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:56050 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752375AbdEIMPD (ORCPT ); Tue, 9 May 2017 08:15:03 -0400 Subject: Patch "brcmfmac: Ensure pointer correctly set if skb data location changes" has been added to the 3.18-stable tree To: james.hughes@raspberrypi.org, arend.vanspriel@broadcom.com, gregkh@linuxfoundation.org, kvalo@codeaurora.org Cc: , From: Date: Tue, 09 May 2017 14:14:53 +0200 Message-ID: <1494332093101114@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled brcmfmac: Ensure pointer correctly set if skb data location changes to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch and it can be found in the queue-3.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 455a1eb4654c24560eb9dfc634f29cba3d87601e Mon Sep 17 00:00:00 2001 From: James Hughes Date: Mon, 24 Apr 2017 12:40:50 +0100 Subject: brcmfmac: Ensure pointer correctly set if skb data location changes From: James Hughes commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream. The incoming skb header may be resized if header space is insufficient, which might change the data adddress in the skb. Ensure that a cached pointer to that data is correctly set by moving assignment to after any possible changes. Signed-off-by: James Hughes Acked-by: Arend van Spriel Signed-off-by: Kalle Valo Signed-off-by: Arend van Spriel Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c @@ -192,7 +192,7 @@ static netdev_tx_t brcmf_netdev_start_xm int ret; struct brcmf_if *ifp = netdev_priv(ndev); struct brcmf_pub *drvr = ifp->drvr; - struct ethhdr *eh = (struct ethhdr *)(skb->data); + struct ethhdr *eh; brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx); @@ -238,6 +238,8 @@ static netdev_tx_t brcmf_netdev_start_xm goto done; } + eh = (struct ethhdr *)(skb->data); + if (eh->h_proto == htons(ETH_P_PAE)) atomic_inc(&ifp->pend_8021x_cnt); Patches currently in stable-queue which might be from james.hughes@raspberrypi.org are queue-3.18/brcmfmac-make-skb-header-writable-before-use.patch queue-3.18/brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch