[PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Arend van Spriel]

From: James Hughes <james.hughes@raspberrypi.org>

commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream

The incoming skb header may be resized if header space is
insufficient, which might change the data adddress in the skb.
Ensure that a cached pointer to that data is correctly set by
moving assignment to after any possible changes.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
This patch should be applied to the linux-4.4.y and linux-4.1.y
branches.

Regards,
Arend
---
 drivers/net/wireless/brcm80211/brcmfmac/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index b5ab98e..eb0e9fd 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -211,7 +211,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 	int ret;
 	struct brcmf_if *ifp = netdev_priv(ndev);
 	struct brcmf_pub *drvr = ifp->drvr;
-	struct ethhdr *eh = (struct ethhdr *)(skb->data);
+	struct ethhdr *eh;
 
 	brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
@@ -257,6 +257,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 		goto done;
 	}
 
+	eh = (struct ethhdr *)(skb->data);
+
 	if (eh->h_proto == htons(ETH_P_PAE))
 		atomic_inc(&ifp->pend_8021x_cnt);
 
-- 
1.9.1

[PATCH stable-4.4 2/2] brcmfmac: Make skb header writable before use

[Arend van Spriel]

From: James Hughes <james.hughes@raspberrypi.org>

commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream

The driver was making changes to the skb_header without
ensuring it was writable (i.e. uncloned).
This patch also removes some boiler plate header size
checking/adjustment code as that is also handled by the
skb_cow_header function used to make header writable.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
This patch should be applied to the linux-4.4.y and linux-4.1.y
branches.

Regards,
Arend
---
 drivers/net/wireless/brcm80211/brcmfmac/core.c | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index eb0e9fd..82753e7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -232,22 +232,13 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 		goto done;
 	}
 
-	/* Make sure there's enough room for any header */
-	if (skb_headroom(skb) < drvr->hdrlen) {
-		struct sk_buff *skb2;
-
-		brcmf_dbg(INFO, "%s: insufficient headroom\n",
+	/* Make sure there's enough writable headroom*/
+	ret = skb_cow_head(skb, drvr->hdrlen);
+	if (ret < 0) {
+		brcmf_err("%s: skb_cow_head failed\n",
 			  brcmf_ifname(drvr, ifp->bssidx));
-		drvr->bus_if->tx_realloc++;
-		skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
 		dev_kfree_skb(skb);
-		skb = skb2;
-		if (skb == NULL) {
-			brcmf_err("%s: skb_realloc_headroom failed\n",
-				  brcmf_ifname(drvr, ifp->bssidx));
-			ret = -ENOMEM;
-			goto done;
-		}
+		goto done;
 	}
 
 	/* validate length for ether packet */
-- 
1.9.1

Re: [PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Greg KH]

On Tue, May 09, 2017 at 11:21:13AM +0100, Arend van Spriel wrote:
> From: James Hughes <james.hughes@raspberrypi.org>
> 
> commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream
> 
> The incoming skb header may be resized if header space is
> insufficient, which might change the data adddress in the skb.
> Ensure that a cached pointer to that data is correctly set by
> moving assignment to after any possible changes.
> 
> Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> ---
> This patch should be applied to the linux-4.4.y and linux-4.1.y
> branches.

Now applied to the 4.4 trees.  I've also added it to 3.18, thanks for
the patches!

greg k-h

Re: [PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Arend Van Spriel]

On 9-5-2017 14:14, Greg KH wrote:
> On Tue, May 09, 2017 at 11:21:13AM +0100, Arend van Spriel wrote:
>> From: James Hughes <james.hughes@raspberrypi.org>
>>
>> commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream
>>
>> The incoming skb header may be resized if header space is
>> insufficient, which might change the data adddress in the skb.
>> Ensure that a cached pointer to that data is correctly set by
>> moving assignment to after any possible changes.
>>
>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
>> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>> ---
>> This patch should be applied to the linux-4.4.y and linux-4.1.y
>> branches.
> 
> Now applied to the 4.4 trees.  I've also added it to 3.18, thanks for
> the patches!

Ok. I did not check 3.18 as it is marked EOL on kernel.org. I checked
just now and the patch does not apply to 3.18 as is.

Regards,
Arend

Re: [PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Arend Van Spriel]

On 9-5-2017 14:17, Arend Van Spriel wrote:
> 
> 
> On 9-5-2017 14:14, Greg KH wrote:
>> On Tue, May 09, 2017 at 11:21:13AM +0100, Arend van Spriel wrote:
>>> From: James Hughes <james.hughes@raspberrypi.org>
>>>
>>> commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream
>>>
>>> The incoming skb header may be resized if header space is
>>> insufficient, which might change the data adddress in the skb.
>>> Ensure that a cached pointer to that data is correctly set by
>>> moving assignment to after any possible changes.
>>>
>>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
>>> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>>> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>>> ---
>>> This patch should be applied to the linux-4.4.y and linux-4.1.y
>>> branches.
>>
>> Now applied to the 4.4 trees.  I've also added it to 3.18, thanks for
>> the patches!
> 
> Ok. I did not check 3.18 as it is marked EOL on kernel.org. I checked
> just now and the patch does not apply to 3.18 as is.

Hi Greg,

I send the patches marked for stable-3.16 as well. Those patches apply
(and build) to linux-3.18.y as well.

Regards,
Arend

Re: [PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Greg KH]

On Tue, May 09, 2017 at 02:17:59PM +0200, Arend Van Spriel wrote:
> 
> 
> On 9-5-2017 14:14, Greg KH wrote:
> > On Tue, May 09, 2017 at 11:21:13AM +0100, Arend van Spriel wrote:
> >> From: James Hughes <james.hughes@raspberrypi.org>
> >>
> >> commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream
> >>
> >> The incoming skb header may be resized if header space is
> >> insufficient, which might change the data adddress in the skb.
> >> Ensure that a cached pointer to that data is correctly set by
> >> moving assignment to after any possible changes.
> >>
> >> Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
> >> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> >> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> >> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> >> ---
> >> This patch should be applied to the linux-4.4.y and linux-4.1.y
> >> branches.
> > 
> > Now applied to the 4.4 trees.  I've also added it to 3.18, thanks for
> > the patches!
> 
> Ok. I did not check 3.18 as it is marked EOL on kernel.org. I checked
> just now and the patch does not apply to 3.18 as is.

Well, I renamed the file in the diff and all was fine :)

And yes, it does say EOL on kernel.org, I'm just maintaining it on my
own for a bit, no need for you to take extra time on your end.

thanks,

greg k-h

Re: [PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Arend Van Spriel]

On 9-5-2017 14:29, Greg KH wrote:
> On Tue, May 09, 2017 at 02:17:59PM +0200, Arend Van Spriel wrote:
>>
>>
>> On 9-5-2017 14:14, Greg KH wrote:
>>> On Tue, May 09, 2017 at 11:21:13AM +0100, Arend van Spriel wrote:
>>>> From: James Hughes <james.hughes@raspberrypi.org>
>>>>
>>>> commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream
>>>>
>>>> The incoming skb header may be resized if header space is
>>>> insufficient, which might change the data adddress in the skb.
>>>> Ensure that a cached pointer to that data is correctly set by
>>>> moving assignment to after any possible changes.
>>>>
>>>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
>>>> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>>>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>>>> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>>>> ---
>>>> This patch should be applied to the linux-4.4.y and linux-4.1.y
>>>> branches.
>>>
>>> Now applied to the 4.4 trees.  I've also added it to 3.18, thanks for
>>> the patches!
>>
>> Ok. I did not check 3.18 as it is marked EOL on kernel.org. I checked
>> just now and the patch does not apply to 3.18 as is.
> 
> Well, I renamed the file in the diff and all was fine :)
> 
> And yes, it does say EOL on kernel.org, I'm just maintaining it on my
> own for a bit, no need for you to take extra time on your end.

Thanks. btw did you queue it for 4.1 as well. I indicated it above, but
I did not get the usual "patch has been added..." email for 4.1.

Regards,
Arend

Re: [PATCH stable-4.4 1/2] brcmfmac: Ensure pointer correctly set if skb data location changes

[Greg KH]

On Tue, May 09, 2017 at 08:17:59PM +0200, Arend Van Spriel wrote:
> On 9-5-2017 14:29, Greg KH wrote:
> > On Tue, May 09, 2017 at 02:17:59PM +0200, Arend Van Spriel wrote:
> >>
> >>
> >> On 9-5-2017 14:14, Greg KH wrote:
> >>> On Tue, May 09, 2017 at 11:21:13AM +0100, Arend van Spriel wrote:
> >>>> From: James Hughes <james.hughes@raspberrypi.org>
> >>>>
> >>>> commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream
> >>>>
> >>>> The incoming skb header may be resized if header space is
> >>>> insufficient, which might change the data adddress in the skb.
> >>>> Ensure that a cached pointer to that data is correctly set by
> >>>> moving assignment to after any possible changes.
> >>>>
> >>>> Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
> >>>> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> >>>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> >>>> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> >>>> ---
> >>>> This patch should be applied to the linux-4.4.y and linux-4.1.y
> >>>> branches.
> >>>
> >>> Now applied to the 4.4 trees.  I've also added it to 3.18, thanks for
> >>> the patches!
> >>
> >> Ok. I did not check 3.18 as it is marked EOL on kernel.org. I checked
> >> just now and the patch does not apply to 3.18 as is.
> > 
> > Well, I renamed the file in the diff and all was fine :)
> > 
> > And yes, it does say EOL on kernel.org, I'm just maintaining it on my
> > own for a bit, no need for you to take extra time on your end.
> 
> Thanks. btw did you queue it for 4.1 as well. I indicated it above, but
> I did not get the usual "patch has been added..." email for 4.1.

I am not the 4.1-stable tree maintainer, so no, I didn't.

See:
	https://www.kernel.org/category/releases.html
for a list of the currently active stable trees, and who is maintaining
them.

thanks,

greg k-h