From dc382f43ddeb0aa436b3b3b2888ca7a10e33189a Mon Sep 17 00:00:00 2001 From: Arend van Spriel Date: Wed, 2 Jan 2013 15:22:46 +0100 Subject: [PATCH] --- yaml --- r: 351815 b: refs/heads/master c: 12b33dacb4bb3780512d3c6a4d064d9ed1172c0e h: refs/heads/master i: 351813: 3d4e4375b67dcb9573b7f63b3bc15eb68a14ea14 351811: 8c8f84705c9f493cdf7ef55ff677e8aca9d4179c 351807: 6c6f5a9de6756aafeb3a8b17f2cf83d68537aa2a v: v3 --- [refs] | 2 +- .../wireless/brcm80211/brcmfmac/dhd_linux.c | 22 +++++++++++-------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/[refs] b/[refs] index 0ef8594abbc8..3d9719dae8e1 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 7833b5799fb4dd201d6808c164712ea9d0c3dec0 +refs/heads/master: 12b33dacb4bb3780512d3c6a4d064d9ed1172c0e diff --git a/trunk/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/trunk/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c index a1ca6912ef28..9ca74118e131 100644 --- a/trunk/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c +++ b/trunk/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c @@ -165,6 +165,7 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev) int ret; struct brcmf_if *ifp = netdev_priv(ndev); struct brcmf_pub *drvr = ifp->drvr; + struct ethhdr *eh; brcmf_dbg(TRACE, "Enter\n"); @@ -202,17 +203,20 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev) } } - /* Update multicast statistic */ - if (skb->len >= ETH_ALEN) { - u8 *pktdata = (u8 *)(skb->data); - struct ethhdr *eh = (struct ethhdr *)pktdata; - - if (is_multicast_ether_addr(eh->h_dest)) - drvr->tx_multicast++; - if (ntohs(eh->h_proto) == ETH_P_PAE) - atomic_inc(&drvr->pend_8021x_cnt); + /* validate length for ether packet */ + if (skb->len < sizeof(*eh)) { + ret = -EINVAL; + dev_kfree_skb(skb); + goto done; } + /* handle ethernet header */ + eh = (struct ethhdr *)(skb->data); + if (is_multicast_ether_addr(eh->h_dest)) + drvr->tx_multicast++; + if (ntohs(eh->h_proto) == ETH_P_PAE) + atomic_inc(&drvr->pend_8021x_cnt); + /* If the protocol uses a data header, apply it */ brcmf_proto_hdrpush(drvr, ifp->idx, skb);