mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-11-01 17:08:10 +00:00
e9024a059f
On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting crashes. Fix that by using skb->data instead. This highlights a problem with usb_fill_bulk_urb(). It doesn't notice when dma_map_single() fails and return the error to its caller as it should. In fact it _can't_ currently return the error, since it returns void. So this problem was showing up only at unmap time, after we'd already suffered memory corruption by doing DMA to a bogus address. Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Cc: stable@kernel.org Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> |
||
---|---|---|
.. | ||
ath | ||
b43 | ||
b43legacy | ||
hostap | ||
ipw2x00 | ||
iwlwifi | ||
iwmc3200wifi | ||
libertas | ||
libertas_tf | ||
orinoco | ||
p54 | ||
prism54 | ||
rt2x00 | ||
rtl818x | ||
wl12xx | ||
zd1211rw | ||
adm8211.c | ||
adm8211.h | ||
airo.c | ||
airo.h | ||
airo_cs.c | ||
arlan-main.c | ||
arlan-proc.c | ||
arlan.h | ||
at76c50x-usb.c | ||
at76c50x-usb.h | ||
atmel.c | ||
atmel.h | ||
atmel_cs.c | ||
atmel_pci.c | ||
i82586.h | ||
i82593.h | ||
Kconfig | ||
mac80211_hwsim.c | ||
Makefile | ||
mwl8k.c | ||
netwave_cs.c | ||
ray_cs.c | ||
ray_cs.h | ||
rayctl.h | ||
rndis_wlan.c | ||
strip.c | ||
wavelan.c | ||
wavelan.h | ||
wavelan.p.h | ||
wavelan_cs.c | ||
wavelan_cs.h | ||
wavelan_cs.p.h | ||
wl3501.h | ||
wl3501_cs.c | ||
zd1201.c | ||
zd1201.h |