Re: BUG in the PCNET32 ethernet driver

[Jeff Garzik <jgarzik@pobox.com>]

Carsten Langgaard wrote:

> Jeff Garzik wrote:
>
>
> >Carsten Langgaard wrote:
> >
> >
> >>@@ -1316,13 +1316,13 @@
> >>                  if ((newskb = dev_alloc_skb (PKT_BUF_SZ))) {
> >>                      skb_reserve (newskb, 2);
> >>                      skb = lp->rx_skbuff[entry];
> >>-                     pci_unmap_single(lp->pci_dev, 
> lp->rx_dma_addr[entry], skb->len,
> >>PCI_DMA_FROMDEVICE);
> >>+                     pci_unmap_single(lp->pci_dev, 
> lp->rx_dma_addr[entry], pkt_len +2,
> >>PCI_DMA_FROMDEVICE);
> >>                      skb_put (skb, pkt_len);
> >>                      lp->rx_skbuff[entry] = newskb;
> >
> >Why does this line not reference PKT_BUF_SZ when all the others do?
>
>
> In this case we know the size of the packet and therefore only need to 
> handle that.
> In the other cases we don't know have big the receiving packet is 
> going to be, so we has to
> take care of the whole buffer.



Well, it's a seriously bad idea to pass different values to map and 
unmap steps, because on some platforms you could wind up telling the 
IOMMU or some other allocator that you are allocating N bytes, but 
freeing N-M bytes.  IOW, a leak.

Now that that's been clarified, please fix up the patch and resubmit... 
  with this issue fixed, it looks apply-able.

	Jeff