diff options
| author | Nicu Ioan Petru <ionut.nicu@freescale.com> | 2007-04-13 01:26:29 -0500 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2007-04-28 11:01:05 -0400 |
| commit | 3a8205ead4dc4b05fbc164eeb852b8f8921d11d3 (patch) | |
| tree | d78277465c1a5bfc31f2855145da5715ed2648f3 /drivers/net/ucc_geth.c | |
| parent | d5b9049df25f38b3eaf3af48d494b0747aae4349 (diff) | |
| download | lwn-3a8205ead4dc4b05fbc164eeb852b8f8921d11d3.tar.gz lwn-3a8205ead4dc4b05fbc164eeb852b8f8921d11d3.zip | |
ucc_geth: fixes for ucc_geth_memclean
The ucc_geth_memclean function can be called before the Tx BD rings, Rx
BD rings and associated socket buffers are allocated (for example if
ucc_fast_init fails). The current code doesn't check if p_tx_bd_ring[i]
is null, generating a kernel panic when trying to free the associated
socket buffers.
The function can also fail when accessing the uninitialized list_head
structures ugeth->group_hash_q and ugeth->ind_hash_q. In the current
implementation the list heads are initialized only when
maxGroupAddrInHash and maxIndAddrInHash are positive values, although I
think it's better to always initialize them.
Signed-off-by: Ionut Nicu <ionut.nicu@freescale.com>
Signed-off-by: Kim Phillips <kim.phillips@freescale.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/ucc_geth.c')
| -rw-r--r-- | drivers/net/ucc_geth.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c index 60844a6f4928..20bc105bcbc9 100644 --- a/drivers/net/ucc_geth.c +++ b/drivers/net/ucc_geth.c @@ -2133,6 +2133,8 @@ static void ucc_geth_memclean(struct ucc_geth_private *ugeth) } for (i = 0; i < ugeth->ug_info->numQueuesTx; i++) { bd = ugeth->p_tx_bd_ring[i]; + if (!bd) + continue; for (j = 0; j < ugeth->ug_info->bdRingLenTx[i]; j++) { if (ugeth->tx_skbuff[i][j]) { dma_unmap_single(NULL, @@ -2300,6 +2302,10 @@ static int ucc_struct_init(struct ucc_geth_private *ugeth) ug_info = ugeth->ug_info; uf_info = &ug_info->uf_info; + /* Create CQs for hash tables */ + INIT_LIST_HEAD(&ugeth->group_hash_q); + INIT_LIST_HEAD(&ugeth->ind_hash_q); + if (!((uf_info->bd_mem_part == MEM_PART_SYSTEM) || (uf_info->bd_mem_part == MEM_PART_MURAM))) { ugeth_err("%s: Bad memory partition value.", __FUNCTION__); @@ -3132,13 +3138,6 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth) for (j = 0; j < NUM_OF_PADDRS; j++) ugeth_82xx_filtering_clear_addr_in_paddr(ugeth, (u8) j); - /* Create CQs for hash tables */ - if (ug_info->maxGroupAddrInHash > 0) { - INIT_LIST_HEAD(&ugeth->group_hash_q); - } - if (ug_info->maxIndAddrInHash > 0) { - INIT_LIST_HEAD(&ugeth->ind_hash_q); - } p_82xx_addr_filt = (struct ucc_geth_82xx_address_filtering_pram *) ugeth-> p_rx_glbl_pram->addressfiltering; |