lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

korina: add error-handling to korina_alloc_ring

Browse Source 
This also avoids a potential buffer overflow in case the very first
receive descriptor fails to allocate, as an index of -1 would be used
afterwards. Kudos to Roel Kluin for pointing this out and providing an
initial patch.

Signed-off-by: Phil Sutter <n0-1@freewrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Phil Sutter
2009-08-12 12:52:32 +00:00
committed by David S. Miller
parent f16aea4d20
commit 7010837a44
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/korina.c
View File

@@ -750,7 +750,7 @@ static struct ethtool_ops netdev_ethtool_ops = {
.get_link = netdev_get_link, .get_link = netdev_get_link,
}; };
static void korina_alloc_ring(struct net_device *dev) static int korina_alloc_ring(struct net_device *dev)
{ {
struct korina_private *lp = netdev_priv(dev); struct korina_private *lp = netdev_priv(dev);
struct sk_buff *skb; struct sk_buff *skb;
@@ -771,7 +771,7 @@ static void korina_alloc_ring(struct net_device *dev)
for (i = 0; i < KORINA_NUM_RDS; i++) { for (i = 0; i < KORINA_NUM_RDS; i++) {
skb = dev_alloc_skb(KORINA_RBSIZE + 2); skb = dev_alloc_skb(KORINA_RBSIZE + 2);
if (!skb) if (!skb)
break; return -ENOMEM;
skb_reserve(skb, 2); skb_reserve(skb, 2);
lp->rx_skb[i] = skb; lp->rx_skb[i] = skb;
lp->rd_ring[i].control = DMA_DESC_IOD | lp->rd_ring[i].control = DMA_DESC_IOD |
@@ -790,6 +790,8 @@ static void korina_alloc_ring(struct net_device *dev)
lp->rx_chain_head = 0; lp->rx_chain_head = 0;
lp->rx_chain_tail = 0; lp->rx_chain_tail = 0;
lp->rx_chain_status = desc_empty; lp->rx_chain_status = desc_empty;
return 0;
} }
static void korina_free_ring(struct net_device *dev) static void korina_free_ring(struct net_device *dev)
@@ -832,7 +834,11 @@ static int korina_init(struct net_device *dev)
writel(ETH_INT_FC_EN, &lp->eth_regs->ethintfc); writel(ETH_INT_FC_EN, &lp->eth_regs->ethintfc);
/* Allocate rings */ /* Allocate rings */
korina_alloc_ring(dev); if (korina_alloc_ring(dev)) {
printk(KERN_ERR "%s: descriptor allocation failed\n", dev->name);
korina_free_ring(dev);
return -ENOMEM;
}
writel(0, &lp->rx_dma_regs->dmas); writel(0, &lp->rx_dma_regs->dmas);
/* Start Rx DMA */ /* Start Rx DMA */