ath6kl: assure headroom of skbuff is writable in .start_xmit()
authorArend Van Spriel <arend.vanspriel@broadcom.com>
Tue, 25 Apr 2017 09:10:08 +0000 (10:10 +0100)
committerKalle Valo <kvalo@qca.qualcomm.com>
Fri, 19 May 2017 07:47:04 +0000 (10:47 +0300)
An issue was found brcmfmac driver in which a skbuff in .start_xmit()
callback was actually cloned. So instead of checking for sufficient
headroom it should also be writable. Hence use skb_cow_head() to
check and expand the headroom appropriately.

Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Tested-by: Steve deRosier <derosier@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
drivers/net/wireless/ath/ath6kl/txrx.c

index a531e0c5c1e28514c0a8bb32f18c4f0808ec6f18..e6b2517e633498a26e82bf0982049c083e703268 100644 (file)
@@ -399,15 +399,10 @@ int ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)
                        csum_dest = skb->csum_offset + csum_start;
                }
 
-               if (skb_headroom(skb) < dev->needed_headroom) {
-                       struct sk_buff *tmp_skb = skb;
-
-                       skb = skb_realloc_headroom(skb, dev->needed_headroom);
-                       kfree_skb(tmp_skb);
-                       if (skb == NULL) {
-                               dev->stats.tx_dropped++;
-                               return 0;
-                       }
+               if (skb_cow_head(skb, dev->needed_headroom)) {
+                       dev->stats.tx_dropped++;
+                       kfree_skb(skb);
+                       return 0;
                }
 
                if (ath6kl_wmi_dix_2_dot3(ar->wmi, skb)) {