]> rtime.felk.cvut.cz Git - sojka/nv-tegra/linux-3.10.git/commit
Re-order bus header field before payload msg
authorSrinivas Ramachandran <srinivasra@nvidia.com>
Wed, 16 Sep 2015 21:42:20 +0000 (14:42 -0700)
committermobile promotions <svcmobile_promotions@nvidia.com>
Tue, 22 Sep 2015 11:51:09 +0000 (04:51 -0700)
commitc324a8d6c97445f1be79c4df633c91d8f08d41ba
tree39ec5dc418b3b31895f226b78b3071c5ed4e912d
parentfed21ff65bb47759231582f73916fe42aab6b64a
Re-order bus header field before payload msg

The DHD driver implementation derives the bus header
pointer based on the msg payload pointer, assuming
the header memory is always before the msg payload.

DHD ver 1.201.82 has swapped the order of msg payload
field to be before bus header in struct dhd_prot_t.
This causes memory corruption when the driver tries to
access header contents by seeking the msg pointer
backwards.

Previous versions of the DHD driver do not have this
issue, and later versions 1.363.x have the correct order
(Header before the payload)

Bug 200128157

Change-Id: I33c1c99fad970c6aa221537a5bf0496666ea6d00
Signed-off-by: Srinivas Ramachandran <srinivasra@nvidia.com>
Reviewed-on: http://git-master/r/800359
Reviewed-by: Manikanta Maddireddy <mmaddireddy@nvidia.com>
Reviewed-by: Ashutosh Jha <ajha@nvidia.com>
drivers/net/wireless/bcmdhd/dhd_cdc.c