From patchwork Mon Apr 24 10:52:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Hughes X-Patchwork-Id: 9696025 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A3F88601E9 for ; Mon, 24 Apr 2017 10:52:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8A2672679B for ; Mon, 24 Apr 2017 10:52:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7BDD826B41; Mon, 24 Apr 2017 10:52:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DF5B32679B for ; Mon, 24 Apr 2017 10:52:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1168702AbdDXKwb (ORCPT ); Mon, 24 Apr 2017 06:52:31 -0400 Received: from mx07-00252a01.pphosted.com ([62.209.51.214]:62235 "EHLO mx07-00252a01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1168620AbdDXKw3 (ORCPT ); Mon, 24 Apr 2017 06:52:29 -0400 Received: from pps.filterd (m0102628.ppops.net [127.0.0.1]) by mx07-00252a01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v3OAnBAw011790 for ; Mon, 24 Apr 2017 11:52:27 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raspberrypi.org; h=from : to : cc : subject : date : message-id; s=pp; bh=Z3PE0TipPW3EhQdeCd07zSeWg2bkiL8Tt4BL/xora84=; b=a7wDdIecQADZ3/CWJwCF9O7oXUw04U8Uvh+bwnxzC3h/Gxrtn71PuZa+uve+9o99Kr38 MFRqbN7C0BYE8Jr5Im9rNgTzFvXftgTvydOTS4/5WyK7SxnzJGXp7MqpmNuzvQqBUYGL Gu4UeHmKUe2nCyvoETTi1QRc+Pv6FKzAEPo+Cf/Pb2fJz6RMXMJRMHMVIpJkpAucl0dC r/e8ZvHFnkXx9HF491zfPUiCtvHLWkewbVVpFzRWckssT4x6xxPqmxJokHNEKxg1882V W5s2VRWl9/4WDzRl/SlvXqnAPP2gsVK7tL8CmmYbbMVRjI+jvrx/9zCCSO2WJEinLxuG JQ== Received: from mail-wm0-f71.google.com (mail-wm0-f71.google.com [74.125.82.71]) by mx07-00252a01.pphosted.com with ESMTP id 29yvjys19s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK) for ; Mon, 24 Apr 2017 11:52:27 +0100 Received: by mail-wm0-f71.google.com with SMTP id d79so4496112wma.0 for ; Mon, 24 Apr 2017 03:52:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raspberrypi-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=Z3PE0TipPW3EhQdeCd07zSeWg2bkiL8Tt4BL/xora84=; b=vdJw6wzOcjls5EG8VZTmFCwNBkRFpUbAoIBh+iutgnuGBQMqQbTuKcFqpE3kIotGHR VYPqyLMANkLqeY8iAAmK+xt81pX7PmHhzbPA6WqBYZOvVs7DHViFNH1Mnt9G3NSvczlw d2R6VzVIbV9B7Le+WAOdBe3HmcTeQwTTWiwmtHkEzgK3AY8nqTVLqD3Xx/V8tGL37mpc WJYDewal+RdOCFifan0NdNklhBrhYxSM4z222+ItmK9wAa6/IcwFNpZ6opOhvNAUymO5 QASu8v+/8jx2FGQ48HzWUCpO+0Odu3OArEvQpA5jcmi/oU8qRmkb9ySxIZK/SJIAvsJM KGHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Z3PE0TipPW3EhQdeCd07zSeWg2bkiL8Tt4BL/xora84=; b=tpyg3oGSDGVxb6VPfPmL5OnLXr5hNsj2OGZ9XC7K9Adrg98k6IJumh5Q2/jOXYcbIe CL1/WeOkz0mAbEaxlxoaN3lIj2+p12wKwC89W2whzn8IZs/immVnSgifg8ee9kMq/KvH 5rH2pGPdR0HHAbSIjBeZgCnIqZoBzKtkEsnJFht9CPBeihhrDhNBBkMG7xJzHnrc+c+L BSPUbnhXf/u7It0/74CnK1dGF+c3hNg20tBW5pj/MqRNSxPfI+j97vTqEXHJAwYws/BL j+qKwIXuBRqKqm5G0SKz3255Jz3QSUvLFTji465r0/cucQ5g/P1j5827tbBs9JMw6vox W+og== X-Gm-Message-State: AN3rC/4X7DvI2okE+JdvgPLI0MinuFQQ348QVnmCFUxAg3ETBF86TCpv lAXzVwhzsEvTLRrqYY8aUzMqW0dX2bT1oBzFv1vo8JeCjhoEpeJ9tYE1CgjzZn95S0KgWnCr9Ij 0FR3OGu222ckQG2bNBg== X-Received: by 10.28.154.198 with SMTP id c189mr8833012wme.45.1493031146677; Mon, 24 Apr 2017 03:52:26 -0700 (PDT) X-Received: by 10.28.154.198 with SMTP id c189mr8833000wme.45.1493031146457; Mon, 24 Apr 2017 03:52:26 -0700 (PDT) Received: from jamesh-VirtualBox ([217.33.127.173]) by smtp.gmail.com with ESMTPSA id h8sm2426849wmf.28.2017.04.24.03.52.25 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 24 Apr 2017 03:52:25 -0700 (PDT) From: James Hughes To: Arend van Spriel , Franky Lin , Hante Meuleman , Kalle Valo , linux-wireless@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com, netdev@vger.kernel.org Cc: James Hughes Subject: [PATCH] brcmfmac: Ensure pointer correctly set if skb data location changes Date: Mon, 24 Apr 2017 11:52:19 +0100 Message-Id: <20170424105219.18797-1-james.hughes@raspberrypi.org> X-Mailer: git-send-email 2.11.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-04-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1704240191 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The incoming skb header may be resized if header space is insufficient, which might change the data adddress in the skb. Ensure that a cached pointer to that data is correctly set by moving assignment to after any possible changes. Signed-off-by: James Hughes Acked-by: Arend van Spriel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 5eaac13e2317..934fe00e28a0 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, int ret; struct brcmf_if *ifp = netdev_priv(ndev); struct brcmf_pub *drvr = ifp->drvr; - struct ethhdr *eh = (struct ethhdr *)(skb->data); + struct ethhdr *eh; brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); @@ -229,6 +229,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, } } + eh = (struct ethhdr *)(skb->data); + /* validate length for ether packet */ if (skb->len < sizeof(*eh)) { ret = -EINVAL;