On 9-5-2017 13:52, Arend van Spriel wrote:
> From: James Hughes <james.hughes@xxxxxxxxxxxxxxx>
>
> commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream
>
> The driver was making changes to the skb_header without
> ensuring it was writable (i.e. uncloned).
> This patch also removes some boiler plate header size
> checking/adjustment code as that is also handled by the
> skb_cow_header function used to make header writable.
>
> Signed-off-by: James Hughes <james.hughes@xxxxxxxxxxxxxxx>
> Acked-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
> Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxx>
> Signed-off-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
> ---
> This patch should be applied to the linux-3.2.y branch.
Grrrr. Sending the wrong one again. Please ignore!
Regards,
Arend
> Regards,
> Arend
> ---
> drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c | 19 +++++--------------
> 1 file changed, 5 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
> index 4acbac5..59e2cef 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
> @@ -362,22 +362,13 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev)
> return -ENODEV;
> }
>
> - /* Make sure there's enough room for any header */
> - if (skb_headroom(skb) < drvr_priv->pub.hdrlen) {
> - struct sk_buff *skb2;
> -
> - brcmf_dbg(INFO, "%s: insufficient headroom\n",
> + /* Make sure there's enough writable headroom*/
> + ret = skb_cow_head(skb, drvr_priv->pub.hdrlen);
> + if (ret < 0) {
> + brcmf_err("%s: skb_cow_head failed\n",
> brcmf_ifname(&drvr_priv->pub, ifidx));
> - drvr_priv->pub.tx_realloc++;
> - skb2 = skb_realloc_headroom(skb, drvr_priv->pub.hdrlen);
> dev_kfree_skb(skb);
> - skb = skb2;
> - if (skb == NULL) {
> - brcmf_dbg(ERROR, "%s: skb_realloc_headroom failed\n",
> - brcmf_ifname(&drvr_priv->pub, ifidx));
> - ret = -ENOMEM;
> - goto done;
> - }
> + goto done;
> }
>
> ret = brcmf_sendpkt(&drvr_priv->pub, ifidx, skb);
>