staging: rtl8192u: Fix crash due to pointers being "confusing"

There's no net_device stashed in skb->cb, there's a net_device * there.

To make it *really* clear, also change the write of the dev pointer
into skb->cb from a memcpy() to an assignment.

Fixes: 3fe563249374 ("staging: rtl8192u: r8192U_core.c: Cleaning up ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index dba5274..0a83e2d 100644 (file)
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1043,7 +1043,7 @@ static void rtl8192_hard_data_xmit(struct sk_buff *skb, struct net_device *dev,
 
        spin_lock_irqsave(&priv->tx_lock, flags);
 
-       memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
+       *(struct net_device **)(skb->cb) = dev;
        tcb_desc->bTxEnableFwCalcDur = 1;
        skb_push(skb, priv->ieee80211->tx_headroom);
        ret = rtl8192_tx(dev, skb);
@@ -1093,7 +1093,7 @@ static void rtl8192_tx_isr(struct urb *tx_urb)
        if (!skb)
                return;
 
-       dev = (struct net_device *)(skb->cb);
+       dev = *(struct net_device **)(skb->cb);
        tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
        queue_index = tcb_desc->queue_index;