Merge tag 'wireless-drivers-for-davem-2017-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

Kalle Valo says:

====================
wireless-drivers fixes for 4.13

Two fixes for for brcmfmac, the crash was reported by two people
already so it's a high priority fix.

brcmfmac

* fix a crash in skb headroom handling in v4.13-rc1
* fix a memory leak due to a merge error in v4.6
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 1 insertions, 6 deletions

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 2153e8062b4c..5cc3a07dda9e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -214,7 +214,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 
         /* Make sure there's enough writeable headroom */
         if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
-                head_delta = drvr->hdrlen - skb_headroom(skb);
+                head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
 
                 brcmf_dbg(INFO, "%s: insufficient headroom (%d)\n",
                           brcmf_ifname(ifp), head_delta);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index c3ecec673eb7..f3556122c6ac 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4175,11 +4175,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
                 goto fail;
         }
 
-        /* allocate scatter-gather table. sg support
-         * will be disabled upon allocation failure.
-         */
-        brcmf_sdiod_sgtable_alloc(bus->sdiodev);
-
         /* Query the F2 block size, set roundup accordingly */
         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
         bus->roundup = min(max_roundup, bus->blocksize);