Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78a36f25 authored by Jarek Poplawski's avatar Jarek Poplawski Committed by David S. Miller
Browse files

sundance: Fix oopses with corrupted skb_shared_info 



Joel Soete reported oopses at the beginning of pppoe connections since
v2.6.35. After debugging the bug was found in sundance skb allocation
and dma mapping code, where skb_reserve() bytes aren't taken into
account. This is an old bug, only uncovered by some change in 2.6.35.

Initial debugging patch by: Eric Dumazet <eric.dumazet@gmail.com>

Reported-by: default avatarJoel Soete <soete.joel@scarlet.be>
Tested-by: default avatarJoel Soete <soete.joel@scarlet.be>
Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e0584649

drivers/net/sundance.c

+2 −2
Original line number Diff line number Diff line
@@ -1016,7 +1016,7 @@ static void init_ring(struct net_device *dev) 


	/* Fill in the Rx buffers.  Handle allocation failure gracefully. */

	for (i = 0; i < RX_RING_SIZE; i++) {

		struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz);

		struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz + 2);

		np->rx_skbuff[i] = skb;

		if (skb == NULL)

			break;
@@ -1407,7 +1407,7 @@ static void refill_rx (struct net_device *dev) 
		struct sk_buff *skb;

		entry = np->dirty_rx % RX_RING_SIZE;

		if (np->rx_skbuff[entry] == NULL) {

			skb = dev_alloc_skb(np->rx_buf_sz);

			skb = dev_alloc_skb(np->rx_buf_sz + 2);

			np->rx_skbuff[entry] = skb;

			if (skb == NULL)

				break;		/* Better luck next round. */