Subject: cassini driver skb->truesize bug

From: Laszlo Attila Toth <[email-masked]>
Date: Tue, 04 Dec 2007 15:19:07 +0100

Hello,

we got the following message:
SKB BUG: Invalid truesize (376) len=514, sizeof(sk_buff)=248

It only occurs on larger traffic (at speed 100 Mbps: always), but  not 
when downloading a small web page.

In cas_rx_process_pkt() the the skb's truesize is only set via skb_put()
but it is not used if there are fragments, also skb->len is increased by
the fragment's size, but the truesize member is unchanged. I compared it 
to the implementation in e1000 where  all of the len, datalen and 
trusize members are increased.

If I modify the code to add the fragment's size to the truesize member, 
the driver allocates all available memory after a while.

Regards,
Attila