diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-11-03 07:44:01 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-11-03 07:44:01 -0800 |
| commit | a84216e671c724e0920dfad2fb70828d428ff60a (patch) | |
| tree | a39f53715c73d267d854653dfe275da5fc60e842 /drivers/net/wireless/b43/dma.c | |
| parent | 1836d95928a0f41ada0cbb2a6c4e46b027db9491 (diff) | |
| parent | bcfe3c2046fc4f16544f2b127f1b159dd1fcad8b (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits)
mac80211: check interface is down before type change
cfg80211: fix NULL ptr deref
libertas if_usb: Fix crash on 64-bit machines
mac80211: fix reason code output endianness
mac80211: fix addba timer
ath9k: fix misplaced semicolon on rate control
b43: Fix DMA TX bounce buffer copying
mac80211: fix BSS leak
rt73usb.c : more ids
ipw2200: fix oops on missing firmware
gre: Fix dev_addr clobbering for gretap
sky2: set carrier off in probe
net: fix sk_forward_alloc corruption
pcnet_cs: add cis of PreMax PE-200 ethernet pcmcia card
r8169: Fix card drop incoming VLAN tagged MTU byte large jumbo frames
ibmtr: possible Read buffer overflow?
net: Fix RPF to work with policy routing
net: fix kmemcheck annotations
e1000e: rework disable K1 at 1000Mbps for 82577/82578
e1000e: config PHY via software after resets
...
Diffstat (limited to 'drivers/net/wireless/b43/dma.c')
| -rw-r--r-- | drivers/net/wireless/b43/dma.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c index 8701034569f..de4e804bedf 100644 --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -1157,8 +1157,9 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot) } static int dma_tx_fragment(struct b43_dmaring *ring, - struct sk_buff *skb) + struct sk_buff **in_skb) { + struct sk_buff *skb = *in_skb; const struct b43_dma_ops *ops = ring->ops; struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); u8 *header; @@ -1224,8 +1225,14 @@ static int dma_tx_fragment(struct b43_dmaring *ring, } memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len); + memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb)); + bounce_skb->dev = skb->dev; + skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb)); + info = IEEE80211_SKB_CB(bounce_skb); + dev_kfree_skb_any(skb); skb = bounce_skb; + *in_skb = bounce_skb; meta->skb = skb; meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1); if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) { @@ -1355,7 +1362,11 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb) * static, so we don't need to store it per frame. */ ring->queue_prio = skb_get_queue_mapping(skb); - err = dma_tx_fragment(ring, skb); + /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing + * into the skb data or cb now. */ + hdr = NULL; + info = NULL; + err = dma_tx_fragment(ring, &skb); if (unlikely(err == -ENOKEY)) { /* Drop this packet, as we don't have the encryption key * anymore and must not transmit it unencrypted. */ |