---

yaml
---
r: 6081
b: refs/heads/master
c: 1ddc50d
h: refs/heads/master
i:
  6079: 5ac5efd
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7ba013ac029513eb4b70cfcd4b86e37c5f16c483
+refs/heads/master: 1ddc50d40a19b3524d302d1d6bfd52ac7bc6b6f7

trunk/drivers/net/s2io.c

@@ -1709,7 +1709,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
 	int i, j;
 	mac_info_t *mac_control;
 	struct config_param *config;
-	int cnt = 0;
+	int cnt = 0, frg_cnt;
 
 	mac_control = &nic->mac_control;
 	config = &nic->config;
@@ -1722,11 +1722,33 @@ static void free_tx_buffers(struct s2io_nic *nic)
 			    (struct sk_buff *) ((unsigned long) txdp->
 						Host_Control);
 			if (skb == NULL) {
-				memset(txdp, 0, sizeof(TxD_t));
+				memset(txdp, 0, sizeof(TxD_t) *
+				       config->max_txds);
 				continue;
 			}
+			frg_cnt = skb_shinfo(skb)->nr_frags;
+			pci_unmap_single(nic->pdev, (dma_addr_t)
+					 txdp->Buffer_Pointer,
+					 skb->len - skb->data_len,
+					 PCI_DMA_TODEVICE);
+			if (frg_cnt) {
+				TxD_t *temp;
+				temp = txdp;
+				txdp++;
+				for (j = 0; j < frg_cnt; j++, txdp++) {
+					skb_frag_t *frag =
+					    &skb_shinfo(skb)->frags[j];
+					pci_unmap_page(nic->pdev,
+						       (dma_addr_t)
+						       txdp->
+						       Buffer_Pointer,
+						       frag->size,
+						       PCI_DMA_TODEVICE);
+				}
+				txdp = temp;
+			}
 			dev_kfree_skb(skb);
-			memset(txdp, 0, sizeof(TxD_t));
+			memset(txdp, 0, sizeof(TxD_t) * config->max_txds);
 			cnt++;
 		}
 		DBG_PRINT(INTR_DBG,
@@ -4570,6 +4592,11 @@ static int rx_osm_handler(ring_info_t *ring_data, RxD_t * rxdp)
 		unsigned long long err = rxdp->Control_1 & RXD_T_CODE;
 		DBG_PRINT(ERR_DBG, "%s: Rx error Value: 0x%llx\n",
 			  dev->name, err);
+		dev_kfree_skb(skb);
+		sp->stats.rx_crc_errors++;
+		atomic_dec(&sp->rx_bufs_left[ring_no]);
+		rxdp->Host_Control = 0;
+		return 0;
 	}
 
 	/* Updating statistics */