http://bugzilla.novell.com/show_bug.cgi?id=540589 http://bugzilla.novell.com/show_bug.cgi?id=540589#c16 Jeff Mahoney <jeffm@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO CC| |bphilips@novell.com, | |jbenc@novell.com Info Provider| |jbenc@novell.com --- Comment #16 from Jeff Mahoney <jeffm@novell.com> 2010-01-14 01:02:03 UTC --- Jiri, can you take another look at the patch from comment #8? I think I may have misunderstood what was going on there. If I go back and re-read, I think instead of e.g.: --- a/drivers/staging/rt2860/rt_linux.c +++ b/drivers/staging/rt2860/rt_linux.c @@ -598,8 +598,9 @@ PNDIS_PACKET ClonePacket( // set the correct dataptr and data len pClonedPkt->dev = pRxPkt->dev; pClonedPkt->data = pData; + pClonedPkt->head = pClonedPkt->data; pClonedPkt->len = DataSize; - pClonedPkt->tail = pClonedPkt->data + pClonedPkt->len; + skb_set_tail_pointer(pClonedPkt, pClonedPkt->len); ASSERT(DataSize < 1530); } return pClonedPkt; .. I should have pClonedPkt->head = pClonedPkt->data - pClonedPkt->len; The crash documented in bnc#568307 is due to skb->data < skb->head, which would happen when, after the packet is cloned, an skb_push is done on it since skb->data would underflow by the amount pushed into the buffer. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.