korina: add error-handling to korina_alloc_ring

This also avoids a potential buffer overflow in case the very first
receive descriptor fails to allocate, as an index of -1 would be used
afterwards. Kudos to Roel Kluin for pointing this out and providing an
initial patch.

Signed-off-by: Phil Sutter <n0-1@freewrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 6df9d253cc0a265c5a66811facb3808ae0806bc0..51ca54c8ec5709acd5af92b77f79ce425ec5f27e 100644 (file)
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -750,7 +750,7 @@ static struct ethtool_ops netdev_ethtool_ops = {
        .get_link               = netdev_get_link,
 };
 
-static void korina_alloc_ring(struct net_device *dev)
+static int korina_alloc_ring(struct net_device *dev)
 {
        struct korina_private *lp = netdev_priv(dev);
        struct sk_buff *skb;
@@ -771,7 +771,7 @@ static void korina_alloc_ring(struct net_device *dev)
        for (i = 0; i < KORINA_NUM_RDS; i++) {
                skb = dev_alloc_skb(KORINA_RBSIZE + 2);
                if (!skb)
-                       break;
+                       return -ENOMEM;
                skb_reserve(skb, 2);
                lp->rx_skb[i] = skb;
                lp->rd_ring[i].control = DMA_DESC_IOD |
@@ -790,6 +790,8 @@ static void korina_alloc_ring(struct net_device *dev)
        lp->rx_chain_head = 0;
        lp->rx_chain_tail = 0;
        lp->rx_chain_status = desc_empty;
+
+       return 0;
 }
 
 static void korina_free_ring(struct net_device *dev)
@@ -832,7 +834,11 @@ static int korina_init(struct net_device *dev)
        writel(ETH_INT_FC_EN, &lp->eth_regs->ethintfc);
 
        /* Allocate rings */
-       korina_alloc_ring(dev);
+       if (korina_alloc_ring(dev)) {
+               printk(KERN_ERR "%s: descriptor allocation failed\n", dev->name);
+               korina_free_ring(dev);
+               return -ENOMEM;
+       }
 
        writel(0, &lp->rx_dma_regs->dmas);
        /* Start Rx DMA */