[PATCH 2/3] korina: add error-handling to korina_alloc_ring
From: Phil Sutter <hidden>
Date: 2009-08-09 00:06:37
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
This also avoids a potential buffer overflow in case the very first receive descriptor fails to allocate, as an index of -1 would be used afterwards. Kudos to Roel Kluin for pointing this out and providing an initial patch. Signed-off-by: Phil Sutter <redacted> --- drivers/net/korina.c | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index c09e2ce..d256022 100644
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c@@ -741,7 +741,7 @@ static struct ethtool_ops netdev_ethtool_ops = { .get_link = netdev_get_link, }; -static void korina_alloc_ring(struct net_device *dev) +static int korina_alloc_ring(struct net_device *dev) { struct korina_private *lp = netdev_priv(dev); struct sk_buff *skb;
@@ -762,7 +762,7 @@ static void korina_alloc_ring(struct net_device *dev) for (i = 0; i < KORINA_NUM_RDS; i++) { skb = dev_alloc_skb(KORINA_RBSIZE + 2); if (!skb) - break; + return -ENOMEM; skb_reserve(skb, 2); skb->dev = dev; lp->rx_skb[i] = skb;
@@ -782,6 +782,8 @@ static void korina_alloc_ring(struct net_device *dev) lp->rx_chain_head = 0; lp->rx_chain_tail = 0; lp->rx_chain_status = desc_empty; + + return 0; } static void korina_free_ring(struct net_device *dev)
@@ -824,7 +826,11 @@ static int korina_init(struct net_device *dev) writel(ETH_INT_FC_EN, &lp->eth_regs->ethintfc); /* Allocate rings */ - korina_alloc_ring(dev); + if (korina_alloc_ring(dev)) { + printk(KERN_ERR "%s: descriptor allocation failed\n", dev->name); + korina_free_ring(dev); + return -ENOMEM; + } writel(0, &lp->rx_dma_regs->dmas); /* Start Rx DMA */
--
1.6.0.6