Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3790c8cd authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

net: fix network driver ndo_start_xmit() return values (part 1) 



Fix up drivers that return an errno value to qdisc_restart(), causing
qdisc_restart() to print a warning and requeue/retransmit the skb.

- xpnet: memory allocation error, intention is to drop
- ethoc: oversized packet, packet must be dropped
- ibmlana: skb freed: use after free
- rrunner: skb freed: use after free

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent da678292

drivers/misc/sgi-xp/xpnet.c

+2 −1
Original line number Diff line number Diff line
@@ -450,7 +450,8 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) 
			 "packet\n", sizeof(struct xpnet_pending_msg));



		dev->stats.tx_errors++;

		return -ENOMEM;

		dev_kfree_skb(skb);

		return NETDEV_TX_OK;

	}



	/* get the beginning of the first cacheline and end of last */

drivers/net/ethoc.c

+3 −3
Original line number Diff line number Diff line
@@ -811,7 +811,7 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev) 


	if (unlikely(skb->len > ETHOC_BUFSIZ)) {

		priv->stats.tx_errors++;

		return -EMSGSIZE;

		goto out;

	}



	entry = priv->cur_tx % priv->num_tx;
@@ -840,9 +840,9 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	}



	dev->trans_start = jiffies;

	dev_kfree_skb(skb);



	spin_unlock_irq(&priv->lock);

out:

	dev_kfree_skb(skb);

	return NETDEV_TX_OK;

}

drivers/net/ibmlana.c

+2 −3
Original line number Diff line number Diff line
@@ -815,7 +815,7 @@ static int ibmlana_close(struct net_device *dev) 
static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)

{

	ibmlana_priv *priv = netdev_priv(dev);

	int retval = 0, tmplen, addr;

	int tmplen, addr;

	unsigned long flags;

	tda_t tda;

	int baddr;
@@ -824,7 +824,6 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) 
	   the upper layer is in deep desperation and we simply ignore the frame. */



	if (priv->txusedcnt >= TXBUFCNT) {

		retval = -EIO;

		dev->stats.tx_dropped++;

		goto tx_done;

	}
@@ -874,7 +873,7 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) 
	spin_unlock_irqrestore(&priv->lock, flags);

tx_done:

	dev_kfree_skb(skb);

	return retval;

	return NETDEV_TX_OK;

}



/* switch receiver mode. */

drivers/net/rrunner.c

+1 −1
Original line number Diff line number Diff line
@@ -1425,7 +1425,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev) 
		if (!(new_skb = dev_alloc_skb(len + 8))) {

			dev_kfree_skb(skb);

			netif_wake_queue(dev);

			return -EBUSY;

			return NETDEV_TX_OK;

		}

		skb_reserve(new_skb, 8);

		skb_put(new_skb, len);