From patchwork Wed Jul 29 14:13:24 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: roel kluin X-Patchwork-Id: 30346 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id 313F8B70AD for ; Thu, 30 Jul 2009 00:10:58 +1000 (EST) Received: by ozlabs.org (Postfix) id 21E4EDDD0B; Thu, 30 Jul 2009 00:10:58 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id A9994DDD01 for ; Thu, 30 Jul 2009 00:10:57 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752542AbZG2OKf (ORCPT ); Wed, 29 Jul 2009 10:10:35 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752138AbZG2OKf (ORCPT ); Wed, 29 Jul 2009 10:10:35 -0400 Received: from mail-ew0-f226.google.com ([209.85.219.226]:59289 "EHLO mail-ew0-f226.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751111AbZG2OKe (ORCPT ); Wed, 29 Jul 2009 10:10:34 -0400 Received: by ewy26 with SMTP id 26so856360ewy.37 for ; Wed, 29 Jul 2009 07:10:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=wdvQaZ11psuLztzcYx55ZFLic+8x8/S8am4EMERkw/Y=; b=MyW1blcGxQg3Oi2xMVsNrSFjmcbn4Dgiz8inWZf1maT62NunIx0zkHDlAO1hn3uQU6 U5yi1MRr2lSo96n1tqhJlX6TYDdW6X9btqermUxxZjzmuE4CJVMYClDgXGlaY6DUAX2i rpzkOZOrZ0CBjo/HWjV/XizBvBtjkhJbJH4F8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=wmjMi+p/528XSqE1+MXbTQJcpZdySzNgf+nWtnC8LIH4n4loHi77xeS1q0l1LPdFxO LDB5guKyHqqTvpqloiF6lfPW2lT75u5GiFxecKoOj0YECPhHgHlaRWzP6RTSL60u1hoT KTbe88SvXnOl0sQEKn08IOf9DhgGRbXRA1w04= Received: by 10.216.48.1 with SMTP id u1mr2271128web.189.1248876631463; Wed, 29 Jul 2009 07:10:31 -0700 (PDT) Received: from zoinx.mars (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 7sm328459eyg.25.2009.07.29.07.10.30 (version=SSLv3 cipher=RC4-MD5); Wed, 29 Jul 2009 07:10:30 -0700 (PDT) Message-ID: <4A705904.4020505@gmail.com> Date: Wed, 29 Jul 2009 16:13:24 +0200 From: Roel Kluin User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2 MIME-Version: 1.0 To: Jarek Poplawski CC: "David S. Miller" , netdev , Andrew Morton Subject: Re: [PATCH] 3c515: Write outside array bounds References: <4A6B88B1.9000907@gmail.com> <4A6CC7BD.9020602@gmail.com> In-Reply-To: <4A6CC7BD.9020602@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Op 26-07-09 23:16, Jarek Poplawski schreef: > Roel Kluin wrote, On 07/26/2009 12:35 AM: > >> if dev_alloc_skb() fails on the first iteration, a write to >> cp->rx_ring[-1] occurs. >> >> Signed-off-by: Roel Kluin >> --- >> Please review: can we error return like this? > > > I doubt we can return here: there is a lot of cleaning missing. > > Jarek P. I took drivers/net/3c59x.c as an example Is this going in the right direction? --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c index 3e00fa8..e94867d 100644 --- a/drivers/net/3c515.c +++ b/drivers/net/3c515.c @@ -827,7 +827,7 @@ static int corkscrew_open(struct net_device *dev) skb = dev_alloc_skb(PKT_BUF_SZ); vp->rx_skbuff[i] = skb; if (skb == NULL) - break; /* Bad news! */ + goto error; /* Bad news! */ skb->dev = dev; /* Mark as being used by this device. */ skb_reserve(skb, 2); /* Align IP on 16 byte boundaries */ vp->rx_ring[i].addr = isa_virt_to_bus(skb->data); @@ -864,6 +864,17 @@ static int corkscrew_open(struct net_device *dev) ioaddr + EL3_CMD); return 0; +error: + pr_emerg("%s: no memory for rx ring\n", dev->name); + int j; + for (j = 0; j < i; j++) { + if (vp->rx_skbuff[j]) { + dev_kfree_skb(vp->rx_skbuff[j]); + vp->rx_skbuff[j] = NULL; + } + } + free_irq(dev->irq, dev); + return -ENOMEM; } static void corkscrew_timer(unsigned long data)