This fixes a clobber of the skb that was introduced by the
tx_control->cb conversion patches.
This bug causes a crash when the skb destructor is invoked. That happens
on skb_orphan or skb_kfree.
Signed-off-by: Michael Buesch <[EMAIL PROTECTED]>
---
John, please apply this bugfix to 2.6.27, as the bug is not present in 2.6.26.
Index: wireless-testing/drivers/net/wireless/b43/pio.c
===================================================================
--- wireless-testing.orig/drivers/net/wireless/b43/pio.c 2008-05-23
23:41:06.000000000 +0200
+++ wireless-testing/drivers/net/wireless/b43/pio.c 2008-06-24
12:10:12.000000000 +0200
@@ -583,13 +583,13 @@ void b43_pio_handle_txstatus(struct b43_
if (unlikely(!q))
return;
B43_WARN_ON(!pack);
spin_lock(&q->lock); /* IRQs are already disabled. */
- info = (void *)pack->skb;
+ info = IEEE80211_SKB_CB(pack->skb);
memset(&info->status, 0, sizeof(info->status));
b43_fill_txstatus_report(info, status);
total_len = pack->skb->len + b43_txhdr_size(dev);
total_len = roundup(total_len, 4);
_______________________________________________
Bcm43xx-dev mailing list
[email protected]
https://lists.berlios.de/mailman/listinfo/bcm43xx-dev
