diff options
| author | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2009-09-05 13:23:49 +0200 |
|---|---|---|
| committer | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2009-09-05 15:59:34 +0200 |
| commit | 1821bc19d54009b6f5e6462dd79074d728080839 (patch) | |
| tree | 27c11feb1f613d719ab8d1beff2639ecd3b31dc7 /drivers | |
| parent | ebbb16bffa646f853899ef3fdc0ac7abab888703 (diff) | |
| download | linux-3.10-1821bc19d54009b6f5e6462dd79074d728080839.tar.gz linux-3.10-1821bc19d54009b6f5e6462dd79074d728080839.tar.bz2 linux-3.10-1821bc19d54009b6f5e6462dd79074d728080839.zip | |
firewire: core: fix crash in iso resource management
This fixes a regression due to post 2.6.30 commit "firewire: core: do
not DMA-map stack addresses" 6fdc03709433ccc2005f0f593ae9d9dd04f7b485.
As David Moore noted, a previously correct sizeof() expression became
wrong since the commit changed its argument from an array to a pointer.
This resulted in an oops in ohci_cancel_packet in the shared workqueue
thread's context when an isochronous resource was to be freed.
Reported-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/firewire/core-iso.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c index 110e731f557..1c0b504a42f 100644 --- a/drivers/firewire/core-iso.c +++ b/drivers/firewire/core-iso.c @@ -196,7 +196,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation, switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP, irm_id, generation, SCODE_100, CSR_REGISTER_BASE + CSR_BANDWIDTH_AVAILABLE, - data, sizeof(data))) { + data, 8)) { case RCODE_GENERATION: /* A generation change frees all bandwidth. */ return allocate ? -EAGAIN : bandwidth; @@ -233,7 +233,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation, data[1] = old ^ c; switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP, irm_id, generation, SCODE_100, - offset, data, sizeof(data))) { + offset, data, 8)) { case RCODE_GENERATION: /* A generation change frees all channels. */ return allocate ? -EAGAIN : i; |