Bugfix -- the rx chain is in memory after the tx chain --
the offset being used was wrong, resulting in memory corruption
when the size of the rx and tx rings weren't exactly the same.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
        if (spider_net_init_chain(card, &card->tx_chain, card->descr,
                        PCI_DMA_TODEVICE, card->tx_desc))
                goto alloc_tx_failed;
+
+       /* rx_chain is after tx_chain, so offset is descr + tx_count */
        if (spider_net_init_chain(card, &card->rx_chain,
-                       card->descr + card->rx_desc,
+                       card->descr + card->tx_desc,
                        PCI_DMA_FROMDEVICE, card->rx_desc))
                goto alloc_rx_failed;