Re-order bus header field before payload msg
authorSrinivas Ramachandran <srinivasra@nvidia.com>
Wed, 16 Sep 2015 21:42:20 +0000 (14:42 -0700)
committermobile promotions <svcmobile_promotions@nvidia.com>
Tue, 20 Oct 2015 07:46:13 +0000 (00:46 -0700)
commitd1349401ecc682b897b7905608cc79a98ed8edfd
treea442e335fbcbeee95853387e7f8ad99c72bb19f5
parentf78f36663b6955a5d7c6967209650dc7fb5d41df
Re-order bus header field before payload msg

The DHD driver implementation derives the bus header
pointer based on the msg payload pointer, assuming
the header memory is always before the msg payload.

DHD ver 1.201.82 has swapped the order of msg payload
field to be before bus header in struct dhd_prot_t.
This causes memory corruption when the driver tries to
access header contents by seeking the msg pointer
backwards.

Previous versions of the DHD driver do not have this
issue, and later versions 1.363.x have the correct order
(Header before the payload)

Bug 200128157

Change-Id: I33c1c99fad970c6aa221537a5bf0496666ea6d00
Signed-off-by: Srinivas Ramachandran <srinivasra@nvidia.com>
Reviewed-on: http://git-master/r/800362
Reviewed-by: Ashutosh Jha <ajha@nvidia.com>
Tested-by: Ashutosh Jha <ajha@nvidia.com>
(cherry picked from commit 1c46f75709d86e03bf2a5961e6a5bf3dce651928)
Reviewed-on: http://git-master/r/818003
GVS: Gerrit_Virtual_Submit
Reviewed-by: Hayden Du <haydend@nvidia.com>
drivers/net/wireless/bcmdhd/dhd_cdc.c