This is a note to let you know that I've just added the patch titled staging: rtl8192u: Fix crash due to pointers being "confusing" to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: staging-rtl8192u-fix-crash-due-to-pointers-being-confusing.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From c3f463484bdd0acd15abd5f92399041f79592d06 Mon Sep 17 00:00:00 2001 From: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Date: Thu, 21 Apr 2016 00:19:25 +0100 Subject: staging: rtl8192u: Fix crash due to pointers being "confusing" From: Ben Hutchings <ben@xxxxxxxxxxxxxxx> commit c3f463484bdd0acd15abd5f92399041f79592d06 upstream. There's no net_device stashed in skb->cb, there's a net_device * there. To make it *really* clear, also change the write of the dev pointer into skb->cb from a memcpy() to an assignment. Fixes: 3fe563249374 ("staging: rtl8192u: r8192U_core.c: Cleaning up ...") Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/staging/rtl8192u/r8192U_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/staging/rtl8192u/r8192U_core.c +++ b/drivers/staging/rtl8192u/r8192U_core.c @@ -1050,7 +1050,7 @@ static void rtl8192_hard_data_xmit(struc spin_lock_irqsave(&priv->tx_lock, flags); - memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev)); + *(struct net_device **)(skb->cb) = dev; tcb_desc->bTxEnableFwCalcDur = 1; skb_push(skb, priv->ieee80211->tx_headroom); ret = rtl8192_tx(dev, skb); @@ -1092,7 +1092,7 @@ static int rtl8192_hard_start_xmit(struc static void rtl8192_tx_isr(struct urb *tx_urb) { struct sk_buff *skb = (struct sk_buff *)tx_urb->context; - struct net_device *dev = (struct net_device *)(skb->cb); + struct net_device *dev = *(struct net_device **)(skb->cb); struct r8192_priv *priv = NULL; cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE); u8 queue_index = tcb_desc->queue_index; Patches currently in stable-queue which might be from ben@xxxxxxxxxxxxxxx are queue-4.4/staging-rtl8192u-fix-crash-due-to-pointers-being-confusing.patch