[PATCH] 2/3 staging: hv: fix oops in vmbus - netvsc list_head

[PATCH] 2/3 staging: hv: fix oops in vmbus - netvsc list_head

[Milan Dadok]

Remove incorrect list_head usage. Variable of type list_head was used in
some function's arguments as list item.

Signed-off-by: Milan Dadok <milan@dadok.name>

---
diff -uprN -X /usr/src/linux/Documentation/dontdiff
/usr/src/linux-2.6.32-rc5/drivers/staging/hv/NetVsc.c
/usr/src/linux/drivers/staging/hv/NetVsc.c
--- /usr/src/linux-2.6.32-rc5/drivers/staging/hv/NetVsc.c       2009-10-28
18:13:04.000000000 +0100
+++ /usr/src/linux/drivers/staging/hv/NetVsc.c  2009-10-28
17:49:40.000000000 +0100
@@ -1052,7 +1052,7 @@ static void NetVscOnReceive(struct hv_de
         */
        spin_lock_irqsave(&netDevice->receive_packet_list_lock, flags);
        while (!list_empty(&netDevice->ReceivePacketList)) {
-               list_move_tail(&netDevice->ReceivePacketList, &listHead);
+               list_move_tail(netDevice->ReceivePacketList.next,
&listHead);
                if (++count == vmxferpagePacket->RangeCount + 1)
                        break;
        }
@@ -1071,7 +1071,7 @@ static void NetVscOnReceive(struct hv_de
                /* Return it to the freelist */
                spin_lock_irqsave(&netDevice->receive_packet_list_lock,
flags);
                for (i = count; i != 0; i--) {
-                       list_move_tail(&listHead,
+                       list_move_tail(listHead.next,
                                       &netDevice->ReceivePacketList);
                }
                spin_unlock_irqrestore(&netDevice->receive_packet_list_lock,
@@ -1085,8 +1085,7 @@ static void NetVscOnReceive(struct hv_de
        }

        /* Remove the 1st packet to represent the xfer page packet itself */
-       xferpagePacket = list_entry(&listHead, struct xferpage_packet,
-                                   ListEntry);
+       xferpagePacket = (struct xferpage_packet*)listHead.next;
        list_del(&xferpagePacket->ListEntry);

        /* This is how much we can satisfy */
@@ -1102,8 +1101,7 @@ static void NetVscOnReceive(struct hv_de

        /* Each range represents 1 RNDIS pkt that contains 1 ethernet frame
*/
        for (i = 0; i < (count - 1); i++) {
-               netvscPacket = list_entry(&listHead, struct
hv_netvsc_packet,
-                                         ListEntry);
+               netvscPacket = (struct hv_netvsc_packet*)listHead.next;
                list_del(&netvscPacket->ListEntry);

                /* Initialize the netvsc packet */
---

RE: [PATCH] 2/3 staging: hv: fix oops in vmbus - netvsc list_head

[Hank Janssen]

>Remove incorrect list_head usage. Variable of type list_head was used in
>some function's arguments as list item.

Milan,

I just checked this patch and thanks a million, this corrects the kernel crashing
When loading hv_netvsc :)

We have been working on fixing this issue for the last day or so, and you 
Beat us to it! Excellent!

It looks like you might already have one, but if you need a license for 
Server 2008/R2 to play with for this code, please let me know and I will
Send you one!

Thank you very much!

Hank.