The following commit has been merged in the linux branch: commit 92ec0893ad0996a534a5b605659d3ca31cf5dfd9 Author: Milan Dadok milan@dadok.name Date: Wed Oct 28 23:23:37 2009 +0100

Staging: hv: fix oops in vmbus - netvsc list_head

Remove incorrect list_head usage. Variable of type list_head was used in some function's arguments as list item.

Signed-off-by: Milan Dadok milan@dadok.name Cc: Hank Janssen hjanssen@microsoft.com Cc: Haiyang Zhang haiyangz@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@suse.de

diff --git a/drivers/staging/hv/NetVsc.c b/drivers/staging/hv/NetVsc.c index 1610b84..d384c0d 100644 --- a/drivers/staging/hv/NetVsc.c +++ b/drivers/staging/hv/NetVsc.c @@ -1052,7 +1052,7 @@ static void NetVscOnReceive(struct hv_device *Device, */ spin_lock_irqsave(&netDevice->receive_packet_list_lock, flags); while (!list_empty(&netDevice->ReceivePacketList)) { - list_move_tail(&netDevice->ReceivePacketList, &listHead); + list_move_tail(netDevice->ReceivePacketList.next, &listHead); if (++count == vmxferpagePacket->RangeCount + 1) break; } @@ -1071,7 +1071,7 @@ static void NetVscOnReceive(struct hv_device *Device, /* Return it to the freelist */ spin_lock_irqsave(&netDevice->receive_packet_list_lock, flags); for (i = count; i != 0; i--) { - list_move_tail(&listHead, + list_move_tail(listHead.next, &netDevice->ReceivePacketList); } spin_unlock_irqrestore(&netDevice->receive_packet_list_lock, @@ -1085,8 +1085,7 @@ static void NetVscOnReceive(struct hv_device *Device, }

/* Remove the 1st packet to represent the xfer page packet itself */ - xferpagePacket = list_entry(&listHead, struct xferpage_packet, - ListEntry); + xferpagePacket = (struct xferpage_packet*)listHead.next; list_del(&xferpagePacket->ListEntry);

/* This is how much we can satisfy */ @@ -1102,8 +1101,7 @@ static void NetVscOnReceive(struct hv_device *Device,

/* Each range represents 1 RNDIS pkt that contains 1 ethernet frame */ for (i = 0; i < (count - 1); i++) { - netvscPacket = list_entry(&listHead, struct hv_netvsc_packet, - ListEntry); + netvscPacket = (struct hv_netvsc_packet*)listHead.next; list_del(&netvscPacket->ListEntry);

/* Initialize the netvsc packet */