diff options
| author | Phil Sutter <n0-1@freewrt.org> | 2009-08-12 12:52:32 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-08-13 16:26:12 -0700 |
| commit | 7010837a44813711b66d9e82e90f9641464e515d (patch) | |
| tree | 6d6aab73dd5af93db3f3ef1fa69b5e95688171c9 /drivers/net/korina.c | |
| parent | f16aea4d201018a124f3c1efd7f247fd3b11e4e1 (diff) | |
korina: add error-handling to korina_alloc_ring
This also avoids a potential buffer overflow in case the very first
receive descriptor fails to allocate, as an index of -1 would be used
afterwards. Kudos to Roel Kluin for pointing this out and providing an
initial patch.
Signed-off-by: Phil Sutter <n0-1@freewrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/korina.c')
| -rw-r--r-- | drivers/net/korina.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/drivers/net/korina.c b/drivers/net/korina.c index 6df9d253cc0a..51ca54c8ec57 100644 --- a/drivers/net/korina.c +++ b/drivers/net/korina.c @@ -750,7 +750,7 @@ static struct ethtool_ops netdev_ethtool_ops = { .get_link = netdev_get_link, }; -static void korina_alloc_ring(struct net_device *dev) +static int korina_alloc_ring(struct net_device *dev) { struct korina_private *lp = netdev_priv(dev); struct sk_buff *skb; @@ -771,7 +771,7 @@ static void korina_alloc_ring(struct net_device *dev) for (i = 0; i < KORINA_NUM_RDS; i++) { skb = dev_alloc_skb(KORINA_RBSIZE + 2); if (!skb) - break; + return -ENOMEM; skb_reserve(skb, 2); lp->rx_skb[i] = skb; lp->rd_ring[i].control = DMA_DESC_IOD | @@ -790,6 +790,8 @@ static void korina_alloc_ring(struct net_device *dev) lp->rx_chain_head = 0; lp->rx_chain_tail = 0; lp->rx_chain_status = desc_empty; + + return 0; } static void korina_free_ring(struct net_device *dev) @@ -832,7 +834,11 @@ static int korina_init(struct net_device *dev) writel(ETH_INT_FC_EN, &lp->eth_regs->ethintfc); /* Allocate rings */ - korina_alloc_ring(dev); + if (korina_alloc_ring(dev)) { + printk(KERN_ERR "%s: descriptor allocation failed\n", dev->name); + korina_free_ring(dev); + return -ENOMEM; + } writel(0, &lp->rx_dma_regs->dmas); /* Start Rx DMA */ |