Minor bug in tun.c

Hi all.

I'm currently trying to learn a bit more about driver programming, therefore I'm working a little with tun.c (using the version that comes with 2.6.7). I have some experience with C programming in general, but I'm a newbie when it comes to kernel stuff.

Have a look at the following code (taken from the function tun_net_xmit()):

=== cut ===

	/* Queue packet */
	if (!(tun->flags & TUN_ONE_QUEUE)) {
		/* Normal queueing mode.
		 * Packet scheduler handles dropping. */
		if (skb_queue_len(&tun->readq) >= TUN_READQ_SIZE)
			netif_stop_queue(dev);
	} else {
		/* Single queue mode.
		 * Driver handles dropping itself. */
		if (skb_queue_len(&tun->readq) >= dev->tx_queue_len)
			goto drop;
	}
	skb_queue_tail(&tun->readq, skb);

=== cut ===

Look at the code that is executed when TUN_ONE_QUEUE isn't set in tun->flags. If the length of the queue has reached its maximum value (given as TUN_READQ_SIZE), the current packet still is appended to the queue, thereby exceeding the maximum length by 1.

In my eyes the simplest way to correct that would be to change

		if (skb_queue_len(&tun->readq) >= TUN_READQ_SIZE)

to read

		if (skb_queue_len(&tun->readq) >= TUN_READQ_SIZE - 1)

Please correct me if I'm wrong.

Bye, Mike