epic100: hamachi: yellowfin: Fix skb allocation size

Joel Soete reported oopses during pppoe over sundance NIC, caused by
a bug in skb allocation and dma mapping code, where skb_reserve()
bytes weren't taken into account. As a followup to the patch:
"sundance: Fix oopses with corrupted skb_shared_info" very similar
code is fixed here for three other drivers.

Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Cc: Joel Soete <soete.joel@scarlet.be>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 6 insertions, 6 deletions

diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index aa56963ad558..c353bf3113cc 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -935,7 +935,7 @@ static void epic_init_ring(struct net_device *dev)
 
         /* Fill in the Rx buffers.  Handle allocation failure gracefully. */
         for (i = 0; i < RX_RING_SIZE; i++) {
-                struct sk_buff *skb = dev_alloc_skb(ep->rx_buf_sz);
+                struct sk_buff *skb = dev_alloc_skb(ep->rx_buf_sz + 2);
                 ep->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
@@ -1233,7 +1233,7 @@ static int epic_rx(struct net_device *dev, int budget)
                 entry = ep->dirty_rx % RX_RING_SIZE;
                 if (ep->rx_skbuff[entry] == NULL) {
                         struct sk_buff *skb;
-                        skb = ep->rx_skbuff[entry] = dev_alloc_skb(ep->rx_buf_sz);
+                        skb = ep->rx_skbuff[entry] = dev_alloc_skb(ep->rx_buf_sz + 2);
                         if (skb == NULL)
                                 break;
                         skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
diff --git a/drivers/net/hamachi.c b/drivers/net/hamachi.c
index 9a6485892b3d..80d25ed53344 100644
--- a/drivers/net/hamachi.c
+++ b/drivers/net/hamachi.c
@@ -1202,7 +1202,7 @@ static void hamachi_init_ring(struct net_device *dev)
         }
         /* Fill in the Rx buffers.  Handle allocation failure gracefully. */
         for (i = 0; i < RX_RING_SIZE; i++) {
-                struct sk_buff *skb = dev_alloc_skb(hmp->rx_buf_sz);
+                struct sk_buff *skb = dev_alloc_skb(hmp->rx_buf_sz + 2);
                 hmp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
@@ -1669,7 +1669,7 @@ static int hamachi_rx(struct net_device *dev)
                 entry = hmp->dirty_rx % RX_RING_SIZE;
                 desc = &(hmp->rx_ring[entry]);
                 if (hmp->rx_skbuff[entry] == NULL) {
-                        struct sk_buff *skb = dev_alloc_skb(hmp->rx_buf_sz);
+                        struct sk_buff *skb = dev_alloc_skb(hmp->rx_buf_sz + 2);
 
                         hmp->rx_skbuff[entry] = skb;
                         if (skb == NULL)
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index cd1b3dcd61db..ec47e22fa186 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -744,7 +744,7 @@ static int yellowfin_init_ring(struct net_device *dev)
         }
 
         for (i = 0; i < RX_RING_SIZE; i++) {
-                struct sk_buff *skb = dev_alloc_skb(yp->rx_buf_sz);
+                struct sk_buff *skb = dev_alloc_skb(yp->rx_buf_sz + 2);
                 yp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
@@ -1157,7 +1157,7 @@ static int yellowfin_rx(struct net_device *dev)
         for (; yp->cur_rx - yp->dirty_rx > 0; yp->dirty_rx++) {
                 entry = yp->dirty_rx % RX_RING_SIZE;
                 if (yp->rx_skbuff[entry] == NULL) {
-                        struct sk_buff *skb = dev_alloc_skb(yp->rx_buf_sz);
+                        struct sk_buff *skb = dev_alloc_skb(yp->rx_buf_sz + 2);
                         if (skb == NULL)
                                 break;                          /* Better luck next round. */
                         yp->rx_skbuff[entry] = skb;