summaryrefslogtreecommitdiffstats
path: root/drivers/firewire
diff options
context:
space:
mode:
authorStefan Richter <stefanr@s5r6.in-berlin.de>2009-09-05 13:23:49 +0200
committerStefan Richter <stefanr@s5r6.in-berlin.de>2009-09-05 15:59:34 +0200
commit1821bc19d54009b6f5e6462dd79074d728080839 (patch)
tree27c11feb1f613d719ab8d1beff2639ecd3b31dc7 /drivers/firewire
parentebbb16bffa646f853899ef3fdc0ac7abab888703 (diff)
downloadkernel-crypto-1821bc19d54009b6f5e6462dd79074d728080839.tar.gz
kernel-crypto-1821bc19d54009b6f5e6462dd79074d728080839.tar.xz
kernel-crypto-1821bc19d54009b6f5e6462dd79074d728080839.zip
firewire: core: fix crash in iso resource management
This fixes a regression due to post 2.6.30 commit "firewire: core: do not DMA-map stack addresses" 6fdc03709433ccc2005f0f593ae9d9dd04f7b485. As David Moore noted, a previously correct sizeof() expression became wrong since the commit changed its argument from an array to a pointer. This resulted in an oops in ohci_cancel_packet in the shared workqueue thread's context when an isochronous resource was to be freed. Reported-by: Jonathan Cameron <jic23@cam.ac.uk> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers/firewire')
-rw-r--r--drivers/firewire/core-iso.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 110e731f557..1c0b504a42f 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -196,7 +196,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
irm_id, generation, SCODE_100,
CSR_REGISTER_BASE + CSR_BANDWIDTH_AVAILABLE,
- data, sizeof(data))) {
+ data, 8)) {
case RCODE_GENERATION:
/* A generation change frees all bandwidth. */
return allocate ? -EAGAIN : bandwidth;
@@ -233,7 +233,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
data[1] = old ^ c;
switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
irm_id, generation, SCODE_100,
- offset, data, sizeof(data))) {
+ offset, data, 8)) {
case RCODE_GENERATION:
/* A generation change frees all channels. */
return allocate ? -EAGAIN : i;