Daniel Stone <dani...@collabora.com> wrote: > The commit to rework the headroom check in start_xmit() now calls > pxskb_expand_head() unconditionally if the header is CoW. Unfortunately, > it does so with the delta between the extant headroom and the header > length, which may be negative if there is already sufficient headroom. > > pskb_expand_head() does allow for size being 0, in which case it just > copies, so clamp the header delta to zero. > > Opening Chrome (and all my tabs) on a PCIE device was enough to reliably > hit this. > > Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") > Signed-off-by: Daniel Stone <dani...@collabora.com> > Cc: Arend Van Spriel <arend.vanspr...@broadcom.com> > Cc: James Hughes <james.hug...@raspberrypi.org> > Cc: Hante Meuleman <hante.meule...@broadcom.com> > Cc: Pieter-Paul Giesberts <pieter-paul.giesbe...@broadcom.com> > Cc: Franky Lin <franky....@broadcom.com> > Tested-by: Hans de Goede <hdego...@redhat.com>
Patch applied to wireless-drivers.git, thanks. 58f36b4526ad brcmfmac: Don't grow SKB by negative size -- https://patchwork.kernel.org/patch/9864575/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches