http://bugzilla.novell.com/show_bug.cgi?id=540589
http://bugzilla.novell.com/show_bug.cgi?id=540589#c16
Jeff Mahoney changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |NEEDINFO
CC| |bphilips@novell.com,
| |jbenc@novell.com
Info Provider| |jbenc@novell.com
--- Comment #16 from Jeff Mahoney 2010-01-14 01:02:03 UTC ---
Jiri, can you take another look at the patch from comment #8? I think I may
have misunderstood what was going on there.
If I go back and re-read, I think instead of e.g.:
--- a/drivers/staging/rt2860/rt_linux.c
+++ b/drivers/staging/rt2860/rt_linux.c
@@ -598,8 +598,9 @@ PNDIS_PACKET ClonePacket(
// set the correct dataptr and data len
pClonedPkt->dev = pRxPkt->dev;
pClonedPkt->data = pData;
+ pClonedPkt->head = pClonedPkt->data;
pClonedPkt->len = DataSize;
- pClonedPkt->tail = pClonedPkt->data + pClonedPkt->len;
+ skb_set_tail_pointer(pClonedPkt, pClonedPkt->len);
ASSERT(DataSize < 1530);
}
return pClonedPkt;
.. I should have pClonedPkt->head = pClonedPkt->data - pClonedPkt->len;
The crash documented in bnc#568307 is due to skb->data < skb->head, which would
happen when, after the packet is cloned, an skb_push is done on it since
skb->data would underflow by the amount pushed into the buffer.
--
Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.