* [PATCH] b43: Fix PIO skb clobber
@ 2008-06-24 10:22 Michael Buesch
0 siblings, 0 replies; only message in thread
From: Michael Buesch @ 2008-06-24 10:22 UTC (permalink / raw)
To: John Linville; +Cc: bcm43xx-dev, linux-wireless
This fixes a clobber of the skb that was introduced by the
tx_control->cb conversion patches.
This bug causes a crash when the skb destructor is invoked. That happens
on skb_orphan or skb_kfree.
Signed-off-by: Michael Buesch <mb@bu3sch.de>
---
John, please apply this bugfix to 2.6.27, as the bug is not present in 2.6.26.
Index: wireless-testing/drivers/net/wireless/b43/pio.c
===================================================================
--- wireless-testing.orig/drivers/net/wireless/b43/pio.c 2008-05-23 23:41:06.000000000 +0200
+++ wireless-testing/drivers/net/wireless/b43/pio.c 2008-06-24 12:10:12.000000000 +0200
@@ -583,13 +583,13 @@ void b43_pio_handle_txstatus(struct b43_
if (unlikely(!q))
return;
B43_WARN_ON(!pack);
spin_lock(&q->lock); /* IRQs are already disabled. */
- info = (void *)pack->skb;
+ info = IEEE80211_SKB_CB(pack->skb);
memset(&info->status, 0, sizeof(info->status));
b43_fill_txstatus_report(info, status);
total_len = pack->skb->len + b43_txhdr_size(dev);
total_len = roundup(total_len, 4);
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2008-06-24 10:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-06-24 10:22 [PATCH] b43: Fix PIO skb clobber Michael Buesch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).