1 files changed, 8 insertions, 5 deletions

diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 35a3a50724f..cbedc9ee740 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -933,12 +933,14 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                 if (frag == 0) {
                         /* copy first fragment (including full headers) into
                          * beginning of the fragment cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data, flen);
+                        skb_copy_from_linear_data(skb, skb_put(frag_skb, flen),
+                                                  flen);
                 } else {
                         /* append frame payload to the end of the fragment
                          * cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
-                               flen);
+                        skb_copy_from_linear_data_offset(skb, hdrlen,
+                                                         skb_put(frag_skb,
+                                                                 flen), flen);
                 }
                 dev_kfree_skb(skb);
                 skb = NULL;
@@ -1044,8 +1046,9 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
             skb->len >= ETH_HLEN + ETH_ALEN) {
                 /* Non-standard frame: get addr4 from its bogus location after
                  * the payload */
-                memcpy(skb->data + ETH_ALEN,
-                       skb->data + skb->len - ETH_ALEN, ETH_ALEN);
+                skb_copy_from_linear_data_offset(skb, skb->len - ETH_ALEN,
+                                                 skb->data + ETH_ALEN,
+                                                 ETH_ALEN);
                 skb_trim(skb, skb->len - ETH_ALEN);
         }