[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-driver-devel
Subject:    [PATCH 05/13] Staging: hv: fix oops in vmbus - netvsc list_head
From:       gregkh () suse ! de (Greg Kroah-Hartman)
Date:       2009-10-30 22:12:02
Message-ID: 1256940730-11503-5-git-send-email-gregkh () suse ! de
[Download RAW message or body]

From: Milan Dadok <milan at dadok.name>

Remove incorrect list_head usage. Variable of type list_head was used in
some function's arguments as list item.

Signed-off-by: Milan Dadok <milan at dadok.name>
Cc: Hank Janssen <hjanssen at microsoft.com>
Cc: Haiyang Zhang <haiyangz at microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
---
 drivers/staging/hv/NetVsc.c |   10 ++++------
 1 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/hv/NetVsc.c b/drivers/staging/hv/NetVsc.c
index 1610b84..d384c0d 100644
--- a/drivers/staging/hv/NetVsc.c
+++ b/drivers/staging/hv/NetVsc.c
@@ -1052,7 +1052,7 @@ static void NetVscOnReceive(struct hv_device *Device,
 	 */
 	spin_lock_irqsave(&netDevice->receive_packet_list_lock, flags);
 	while (!list_empty(&netDevice->ReceivePacketList)) {
-		list_move_tail(&netDevice->ReceivePacketList, &listHead);
+		list_move_tail(netDevice->ReceivePacketList.next, &listHead);
 		if (++count == vmxferpagePacket->RangeCount + 1)
 			break;
 	}
@@ -1071,7 +1071,7 @@ static void NetVscOnReceive(struct hv_device *Device,
 		/* Return it to the freelist */
 		spin_lock_irqsave(&netDevice->receive_packet_list_lock, flags);
 		for (i = count; i != 0; i--) {
-			list_move_tail(&listHead,
+			list_move_tail(listHead.next,
 				       &netDevice->ReceivePacketList);
 		}
 		spin_unlock_irqrestore(&netDevice->receive_packet_list_lock,
@@ -1085,8 +1085,7 @@ static void NetVscOnReceive(struct hv_device *Device,
 	}
 
 	/* Remove the 1st packet to represent the xfer page packet itself */
-	xferpagePacket = list_entry(&listHead, struct xferpage_packet,
-				    ListEntry);
+	xferpagePacket = (struct xferpage_packet*)listHead.next;
 	list_del(&xferpagePacket->ListEntry);
 
 	/* This is how much we can satisfy */
@@ -1102,8 +1101,7 @@ static void NetVscOnReceive(struct hv_device *Device,
 
 	/* Each range represents 1 RNDIS pkt that contains 1 ethernet frame */
 	for (i = 0; i < (count - 1); i++) {
-		netvscPacket = list_entry(&listHead, struct hv_netvsc_packet,
-					  ListEntry);
+		netvscPacket = (struct hv_netvsc_packet*)listHead.next;
 		list_del(&netvscPacket->ListEntry);
 
 		/* Initialize the netvsc packet */
-- 
1.6.4.2


[prev in list] [next in list] [prev in thread] [next in thread]