[PATCH] gainfar.c : skb_over_panic (kernel-2.6.32.15)

[Eran Liberty <liberty@extricom.com>]

[-- Attachment #1: Type: text/plain, Size: 597 bytes --]

Fix possible skb_over_panic event in Freescale's "gianfar" driver. 

The skb_over_panic occurs due to calling skb_put() within 
gfar_clean_rx_ring(). This happens if (and only if) shortly prior to the 
event and a few lined above the skb_put(), an skb was queued back to the 
priv->rx_recycle queue due to RXBD_LAST or RXBD_ERR status.
The skb is queued without properly re-setting its state.

The patch properly reset the skb state.

I have tested this patch on MPC8548 based product and asserted it avoided the skb_over_panic event.

Signed-off-by: Eran Liberty <liberty@extricom.com>

---






[-- Attachment #2: gianfar_skb_over_panic.patch --]
[-- Type: text/x-diff, Size: 610 bytes --]

---
 drivers/net/gianfar.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1854,14 +1854,9 @@
 			if (unlikely(!newskb))
 				newskb = skb;
 			else if (skb) {
-				/*
-				 * We need to reset ->data to what it
-				 * was before gfar_new_skb() re-aligned
-				 * it to an RXBUF_ALIGNMENT boundary
-				 * before we put the skb back on the
-				 * recycle list.
-				 */
 				skb->data = skb->head + NET_SKB_PAD;
+				skb->len = 0;
+				skb_reset_tail_pointer(skb);
 				__skb_queue_head(&priv->rx_recycle, skb);
 			}
 		} else {