From: David Woodhouse <dwmw2@xxxxxxxxxxxxx> Date: Fri, 30 Oct 2009 17:45:14 +0000 > On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas > usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting > crashes. Fix that by using skb->data instead. > > This highlights a problem with usb_fill_bulk_urb(). It doesn't notice > when dma_map_single() fails and return the error to its caller as it > should. In fact it _can't_ currently return the error, since it returns > void. > > So this problem was showing up only at unmap time, after we'd already > suffered memory corruption by doing DMA to a bogus address. > > Signed-off-by: David Woodhouse <David.Woodhouse@xxxxxxxxx> > Cc: stable@xxxxxxxxxx Acked-by: David S. Miller <davem@xxxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
