sundance: Fix oopses with corrupted skb_shared_info

Joel Soete reported oopses at the beginning of pppoe connections since v2.6.35. After debugging the bug was found in sundance skb allocation and dma mapping code, where skb_reserve() bytes aren't taken into account. This is an old bug, only uncovered by some change in 2.6.35. Initial debugging patch by: Eric Dumazet <[email protected]> Reported-by: Joel Soete <[email protected]> Tested-by: Joel Soete <[email protected]> Signed-off-by: Jarek Poplawski <[email protected]> Cc: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
klaby · Dec 26, 2010 · 78a36f2 · 78a36f2
1 parent e058464
commit 78a36f2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
@@ -1016,7 +1016,7 @@ static void init_ring(struct net_device *dev)
 
 	/* Fill in the Rx buffers.  Handle allocation failure gracefully. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
-		struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz);
+		struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz + 2);
 		np->rx_skbuff[i] = skb;
 		if (skb == NULL)
 			break;
@@ -1407,7 +1407,7 @@ static void refill_rx (struct net_device *dev)
 		struct sk_buff *skb;
 		entry = np->dirty_rx % RX_RING_SIZE;
 		if (np->rx_skbuff[entry] == NULL) {
-			skb = dev_alloc_skb(np->rx_buf_sz);
+			skb = dev_alloc_skb(np->rx_buf_sz + 2);
 			np->rx_skbuff[entry] = skb;
 			if (skb == NULL)
 				break;		/* Better luck next round. */