Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f73dfc29 authored by James Hughes's avatar James Hughes Committed by Greg Kroah-Hartman
Browse files

brcmfmac: Ensure pointer correctly set if skb data location changes 



commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.

The incoming skb header may be resized if header space is
insufficient, which might change the data adddress in the skb.
Ensure that a cached pointer to that data is correctly set by
moving assignment to after any possible changes.

Signed-off-by: default avatarJames Hughes <james.hughes@raspberrypi.org>
Acked-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b0e2e3ac

drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c

+3 −1
Original line number Diff line number Diff line
@@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, 
	int ret;

	struct brcmf_if *ifp = netdev_priv(ndev);

	struct brcmf_pub *drvr = ifp->drvr;

	struct ethhdr *eh = (struct ethhdr *)(skb->data);

	struct ethhdr *eh;



	brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
@@ -236,6 +236,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, 
		goto done;

	}



	eh = (struct ethhdr *)(skb->data);



	if (eh->h_proto == htons(ETH_P_PAE))

		atomic_inc(&ifp->pend_8021x_cnt);