| Message ID | 20170424105219.18797-1-james.hughes@raspberrypi.org (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
On 4/24/2017 12:52 PM, James Hughes wrote: > The incoming skb header may be resized if header space is > insufficient, which might change the data adddress in the skb. > Ensure that a cached pointer to that data is correctly set by > moving assignment to after any possible changes. Thanks, James Minor nit below... You may add my acknowledgement: Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> > Signed-off-by: James Hughes <james.hughes@raspberrypi.org> > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c [...] > @@ -229,6 +229,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, > } > } > > + eh = (struct ethhdr *)(skb->data); > + Please move after the length validation below. Regards, Arend > /* validate length for ether packet */ > if (skb->len < sizeof(*eh)) { > ret = -EINVAL; >
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 5eaac13e2317..934fe00e28a0 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, int ret; struct brcmf_if *ifp = netdev_priv(ndev); struct brcmf_pub *drvr = ifp->drvr; - struct ethhdr *eh = (struct ethhdr *)(skb->data); + struct ethhdr *eh; brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); @@ -229,6 +229,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, } } + eh = (struct ethhdr *)(skb->data); + /* validate length for ether packet */ if (skb->len < sizeof(*eh)) { ret = -EINVAL;
The incoming skb header may be resized if header space is insufficient, which might change the data adddress in the skb. Ensure that a cached pointer to that data is correctly set by moving assignment to after any possible changes. Signed-off-by: James Hughes <james.hughes@raspberrypi.org> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)