redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

wimax/i2400m: error paths that need to free an skb should use kfree_skb()

Browse source 
Roel Kluin reported a bug in two error paths where skbs were wrongly
being freed using kfree(). He provided a fix where it was replaced to
kfree_skb(), as it should be.

However, in i2400mu_rx(), the error path was missing returning an
indication of the failure. Changed to reset rx_skb to NULL and return
it to the caller, i2400mu_rxd(). It will be treated as a transient
error and just ignore the packet.

Depending on the buffering conditions inside the device, the data
packet might be dropped or the device will signal the host again for
data-ready-to-read and the host will retry.

Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Inaky Perez-Gonzalez 2009-01-19 13:19:30 +00:00 committed by David S. Miller
parent fe65e70453
commit f4895b8bc8
2 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/net/wimax/i2400m/control.c
View file

@ -609,7 +609,7 @@ void i2400m_msg_to_dev_cancel_wait(struct i2400m *i2400m, int code)
spin_lock_irqsave(&i2400m->rx_lock, flags);
ack_skb = i2400m->ack_skb;
if (ack_skb && !IS_ERR(ack_skb))
kfree(ack_skb);
kfree_skb(ack_skb);
i2400m->ack_skb = ERR_PTR(code);
spin_unlock_irqrestore(&i2400m->rx_lock, flags);
}

9
drivers/net/wimax/i2400m/usb-rx.c
View file

@ -184,6 +184,8 @@ void i2400mu_rx_size_maybe_shrink(struct i2400mu *i2400mu)
* NOTE: this function might realloc the skb (if it is too small),
* so always update with the one returned.
* ERR_PTR() is < 0 on error.
* Will return NULL if it cannot reallocate -- this can be
* considered a transient retryable error.
*/
static
struct sk_buff *i2400mu_rx(struct i2400mu *i2400mu, struct sk_buff *rx_skb)
@ -243,8 +245,8 @@ retry:
if (printk_ratelimit())
dev_err(dev, "RX: Can't reallocate skb to %d; "
"RX dropped\n", rx_size);
kfree(rx_skb);
result = 0;
kfree_skb(rx_skb);
rx_skb = NULL;
goto out; /* drop it...*/
}
kfree_skb(rx_skb);
@ -344,7 +346,8 @@ int i2400mu_rxd(void *_i2400mu)
if (IS_ERR(rx_skb))
goto out;
atomic_dec(&i2400mu->rx_pending_count);
if (rx_skb->len == 0) { /* some ignorable condition */
if (rx_skb == NULL || rx_skb->len == 0) {
/* some "ignorable" condition */
kfree_skb(rx_skb);
continue;
}