diff options
| author | Jarek Poplawski <jarkao2@gmail.com> | 2010-12-25 05:12:17 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-12-25 19:37:49 -0800 |
| commit | 78a36f25478432835f2f1e46202b71ff3ae454ff (patch) | |
| tree | 46781d07ae6bc93661e8b7a802f77f37f57c725f | |
| parent | e058464990c2ef1f3ecd6b83a154913c3c06f02a (diff) | |
sundance: Fix oopses with corrupted skb_shared_info
Joel Soete reported oopses at the beginning of pppoe connections since
v2.6.35. After debugging the bug was found in sundance skb allocation
and dma mapping code, where skb_reserve() bytes aren't taken into
account. This is an old bug, only uncovered by some change in 2.6.35.
Initial debugging patch by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-by: Joel Soete <soete.joel@scarlet.be>
Tested-by: Joel Soete <soete.joel@scarlet.be>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/sundance.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c index 3ed2a67bd6d..b409d7ec4ac 100644 --- a/drivers/net/sundance.c +++ b/drivers/net/sundance.c @@ -1016,7 +1016,7 @@ static void init_ring(struct net_device *dev) /* Fill in the Rx buffers. Handle allocation failure gracefully. */ for (i = 0; i < RX_RING_SIZE; i++) { - struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz); + struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz + 2); np->rx_skbuff[i] = skb; if (skb == NULL) break; @@ -1407,7 +1407,7 @@ static void refill_rx (struct net_device *dev) struct sk_buff *skb; entry = np->dirty_rx % RX_RING_SIZE; if (np->rx_skbuff[entry] == NULL) { - skb = dev_alloc_skb(np->rx_buf_sz); + skb = dev_alloc_skb(np->rx_buf_sz + 2); np->rx_skbuff[entry] = skb; if (skb == NULL) break; /* Better luck next round. */ |