Apparently an earlier version of this patch went into w-t, the committed version is still missing the skb_pull removal shown below. It's an error path so it doesn't usually get executed. Also, Christian's patch http://www.spinics.net/lists/linux-wireless/msg27282.html which makes net2280 devices work still hasn't made it. (it fixes an unrelated c&p bug it seems, but that change is obviously correct). artur Christian Lamparter wrote: > In theory, the firmware acks the received a data frame, before signaling the driver to free it again. > However Artur Skawina has shown that it can happen in reverse order as well. > This is very bad and could lead to memory corruptions, oopses and panics. > > Thanks to Artur Skawina <art.08.09@xxxxxxxxx> for reporting and debugging this issue. > > Tested-by: Artur Skawina <art.08.09@xxxxxxxxx> > Signed-off-by: Christian Lamparter <chunkeey@xxxxxx> > --- > Changes: > - removed a forgotten skb_pull from p54u_tx_net2280 error - path. > @@ -360,14 +352,12 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb) > usb_unanchor_urb(data_urb); > goto out; > } > - out: > +out: > usb_free_urb(int_urb); > usb_free_urb(data_urb); > > - if (err) { > - skb_pull(skb, sizeof(*hdr)); > + if (err) > p54_free_skb(dev, skb); > - } > } -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
