Skip to content

Commit 0d89c7a

Browse files
James Hughesgregkh
authored andcommitted
brcmfmac: Ensure pointer correctly set if skb data location changes
commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream. The incoming skb header may be resized if header space is insufficient, which might change the data adddress in the skb. Ensure that a cached pointer to that data is correctly set by moving assignment to after any possible changes. Signed-off-by: James Hughes <james.hughes@raspberrypi.org> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 0112db0 commit 0d89c7a

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

  • drivers/net/wireless/brcm80211/brcmfmac

drivers/net/wireless/brcm80211/brcmfmac/core.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
211211
int ret;
212212
struct brcmf_if *ifp = netdev_priv(ndev);
213213
struct brcmf_pub *drvr = ifp->drvr;
214-
struct ethhdr *eh = (struct ethhdr *)(skb->data);
214+
struct ethhdr *eh;
215215

216216
brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
217217

@@ -257,6 +257,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
257257
goto done;
258258
}
259259

260+
eh = (struct ethhdr *)(skb->data);
261+
260262
if (eh->h_proto == htons(ETH_P_PAE))
261263
atomic_inc(&ifp->pend_8021x_cnt);
262264

0 commit comments

Comments
 (0)