Daniel Stone <daniels@xxxxxxxxxxxxx> wrote:
> The commit to rework the headroom check in start_xmit() now calls
> pxskb_expand_head() unconditionally if the header is CoW. Unfortunately,
> it does so with the delta between the extant headroom and the header
> length, which may be negative if there is already sufficient headroom.
>
> pskb_expand_head() does allow for size being 0, in which case it just
> copies, so clamp the header delta to zero.
>
> Opening Chrome (and all my tabs) on a PCIE device was enough to reliably
> hit this.
>
> Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
> Signed-off-by: Daniel Stone <daniels@xxxxxxxxxxxxx>
> Cc: Arend Van Spriel <arend.vanspriel@xxxxxxxxxxxx>
> Cc: James Hughes <james.hughes@xxxxxxxxxxxxxxx>
> Cc: Hante Meuleman <hante.meuleman@xxxxxxxxxxxx>
> Cc: Pieter-Paul Giesberts <pieter-paul.giesberts@xxxxxxxxxxxx>
> Cc: Franky Lin <franky.lin@xxxxxxxxxxxx>
> Tested-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Patch applied to wireless-drivers.git, thanks.
58f36b4526ad brcmfmac: Don't grow SKB by negative size
--
https://patchwork.kernel.org/patch/9864575/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
