From: Rusty Russell Thanks to Herbert Xu for noticing the bug: "len" here is skb_headlen(), not skb->len. Renamed the function to clarify, too. Signed-off-by: Rusty Russell Cc: Herbert Xu Cc: Andi Kleen Signed-off-by: Andrew Morton --- drivers/net/lguest_net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff -puN drivers/net/lguest_net.c~lguest-trivial-guest-network-driver-fix drivers/net/lguest_net.c --- a/drivers/net/lguest_net.c~lguest-trivial-guest-network-driver-fix +++ a/drivers/net/lguest_net.c @@ -59,14 +59,14 @@ static unsigned long peer_addr(struct lg return info->peer_phys + 4 * peernum; } -static void skb_to_dma(const struct sk_buff *skb, unsigned int len, +static void skb_to_dma(const struct sk_buff *skb, unsigned int headlen, struct lguest_dma *dma) { unsigned int i, seg; - for (i = seg = 0; i < len; seg++, i += rest_of_page(skb->data + i)) { + for (i = seg = 0; i < headlen; seg++, i += rest_of_page(skb->data+i)) { dma->addr[seg] = virt_to_phys(skb->data + i); - dma->len[seg] = min((unsigned)(len - i), + dma->len[seg] = min((unsigned)(headlen - i), rest_of_page(skb->data + i)); } for (i = 0; i < skb_shinfo(skb)->nr_frags; i++, seg++) { @@ -90,7 +90,7 @@ static void transfer_packet(struct net_d struct lguestnet_info *info = dev->priv; struct lguest_dma dma; - skb_to_dma(skb, skb->len, &dma); + skb_to_dma(skb, skb_headlen(skb), &dma); pr_debug("xfer length %04x (%u)\n", htons(skb->len), skb->len); hcall(LHCALL_SEND_DMA, peer_addr(info,peernum), __pa(&dma),0); _