Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c3f46348 authored by Ben Hutchings's avatar Ben Hutchings Committed by Greg Kroah-Hartman
Browse files

staging: rtl8192u: Fix crash due to pointers being "confusing" 



There's no net_device stashed in skb->cb, there's a net_device * there.

To make it *really* clear, also change the write of the dev pointer
into skb->cb from a memcpy() to an assignment.

Fixes: 3fe56324 ("staging: rtl8192u: r8192U_core.c: Cleaning up ...")
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b8a99fb5

drivers/staging/rtl8192u/r8192U_core.c

+2 −2
Original line number Diff line number Diff line
@@ -1043,7 +1043,7 @@ static void rtl8192_hard_data_xmit(struct sk_buff *skb, struct net_device *dev, 


	spin_lock_irqsave(&priv->tx_lock, flags);



	memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));

	*(struct net_device **)(skb->cb) = dev;

	tcb_desc->bTxEnableFwCalcDur = 1;

	skb_push(skb, priv->ieee80211->tx_headroom);

	ret = rtl8192_tx(dev, skb);
@@ -1093,7 +1093,7 @@ static void rtl8192_tx_isr(struct urb *tx_urb) 
	if (!skb)

		return;



	dev = (struct net_device *)(skb->cb);

	dev = *(struct net_device **)(skb->cb);

	tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);

	queue_index = tcb_desc->queue_index;