Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7010837a authored by Phil Sutter's avatar Phil Sutter Committed by David S. Miller
Browse files

korina: add error-handling to korina_alloc_ring 



This also avoids a potential buffer overflow in case the very first
receive descriptor fails to allocate, as an index of -1 would be used
afterwards. Kudos to Roel Kluin for pointing this out and providing an
initial patch.

Signed-off-by: default avatarPhil Sutter <n0-1@freewrt.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f16aea4d

drivers/net/korina.c

+9 −3
Original line number Diff line number Diff line
@@ -750,7 +750,7 @@ static struct ethtool_ops netdev_ethtool_ops = { 
	.get_link               = netdev_get_link,

};



static void korina_alloc_ring(struct net_device *dev)

static int korina_alloc_ring(struct net_device *dev)

{

	struct korina_private *lp = netdev_priv(dev);

	struct sk_buff *skb;
@@ -771,7 +771,7 @@ static void korina_alloc_ring(struct net_device *dev) 
	for (i = 0; i < KORINA_NUM_RDS; i++) {

		skb = dev_alloc_skb(KORINA_RBSIZE + 2);

		if (!skb)

			break;

			return -ENOMEM;

		skb_reserve(skb, 2);

		lp->rx_skb[i] = skb;

		lp->rd_ring[i].control = DMA_DESC_IOD |
@@ -790,6 +790,8 @@ static void korina_alloc_ring(struct net_device *dev) 
	lp->rx_chain_head = 0;

	lp->rx_chain_tail = 0;

	lp->rx_chain_status = desc_empty;



	return 0;

}



static void korina_free_ring(struct net_device *dev)
@@ -832,7 +834,11 @@ static int korina_init(struct net_device *dev) 
	writel(ETH_INT_FC_EN, &lp->eth_regs->ethintfc);



	/* Allocate rings */

	korina_alloc_ring(dev);

	if (korina_alloc_ring(dev)) {

		printk(KERN_ERR "%s: descriptor allocation failed\n", dev->name);

		korina_free_ring(dev);

		return -ENOMEM;

	}



	writel(0, &lp->rx_dma_regs->dmas);

	/* Start Rx DMA */