Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 126c0524 authored by Ying Xue's avatar Ying Xue Committed by David S. Miller
Browse files

tipc: fix wrong return value for link_send_sections_long routine 



When skb buffer cannot be allocated in link_send_sections_long(),
-ENOMEM error code instead of -EFAULT should be returned to its
caller.

Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
Signed-off-by: default avatarPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7410f967

net/tipc/link.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -1168,6 +1168,7 @@ static int link_send_sections_long(struct tipc_port *sender, 
	const unchar *sect_crs;

	const unchar *sect_crs;

	int curr_sect;

	int curr_sect;

	u32 fragm_no;

	u32 fragm_no;

	int res = 0;





again:

again:

	fragm_no = 1;

	fragm_no = 1;
@@ -1215,12 +1216,13 @@ static int link_send_sections_long(struct tipc_port *sender, 
			sz = fragm_rest;

			sz = fragm_rest;





		if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {

		if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {

			res = -EFAULT;

error:

error:

			for (; buf_chain; buf_chain = buf) {

			for (; buf_chain; buf_chain = buf) {

				buf = buf_chain->next;

				buf = buf_chain->next;

				kfree_skb(buf_chain);

				kfree_skb(buf_chain);

			}

			}

			return -EFAULT;

			return res;

		}

		}

		sect_crs += sz;

		sect_crs += sz;

		sect_rest -= sz;

		sect_rest -= sz;
@@ -1241,8 +1243,10 @@ static int link_send_sections_long(struct tipc_port *sender, 
			msg_set_fragm_no(&fragm_hdr, ++fragm_no);

			msg_set_fragm_no(&fragm_hdr, ++fragm_no);

			prev = buf;

			prev = buf;

			buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);

			buf = tipc_buf_acquire(fragm_sz + INT_H_SIZE);

			if (!buf)

			if (!buf) {

				res = -ENOMEM;

				goto error;

				goto error;

			}





			buf->next = NULL;

			buf->next = NULL;

			prev->next = buf;

			prev->next = buf;