Re: [git pull] Input update for 2.6.17

[Marcel Holtmann <marcel@holtmann.org>]

Hi Linus,

> > > Anyway, "urb->transfer_buffer" was initialized with
> > > 
> > > 	urb->transfer_buffer = skb->data;
> > > 
> > > and I'm pretty damn sure you're supposed to just kfree() it.
> > 
> > eh?  I would think dev_kfree_skb(), because who knows whether the skb was
> > cloned, split, data buffer adjusted, destructors need to be called...
> 
> Well, we don't actually have the skb available any more.
> 
> > kfree()ing skb->data sounds like a recipe for corruption and crashes...
> 
> Yeah. But I didn't actually look very deeply, maybe I mistook the init 
> sequence. That said, corruption and crashes is obviously what I see, and 
> why I started looking at it ;)

sorry, I haven't found the time to look into that. The hci_usb driver is
actually a mess and in a desperate need of a rewrite. However I haven't
seen anything like this oops in the past. Let me try to reproduce this.

Regards

Marcel