Browse Source

net: moxa: continue loop on skb allocation failure

If netdev_alloc_skb_ip_align() fails, subsequent code will
try to dereference an invalid pointer.

Continue to next descriptor on error.

While we're at it,

1. eliminate the chance of an endless loop, replace the main
   loop with while(rx < budget)

2. use napi_complete() and remove the explicit napi_gro_flush()

Signed-off-by: Jonas Jensen <jonas.jensen@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jonas Jensen 11 years ago
parent
commit
2b7890e757
1 changed files with 5 additions and 7 deletions
  1. 5 7
      drivers/net/ethernet/moxa/moxart_ether.c

+ 5 - 7
drivers/net/ethernet/moxa/moxart_ether.c

@@ -206,7 +206,7 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
 	int rx_head = priv->rx_head;
 	int rx_head = priv->rx_head;
 	int rx = 0;
 	int rx = 0;
 
 
-	while (1) {
+	while (rx < budget) {
 		desc = priv->rx_desc_base + (RX_REG_DESC_SIZE * rx_head);
 		desc = priv->rx_desc_base + (RX_REG_DESC_SIZE * rx_head);
 		desc0 = readl(desc + RX_REG_OFFSET_DESC0);
 		desc0 = readl(desc + RX_REG_OFFSET_DESC0);
 
 
@@ -218,7 +218,7 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
 			net_dbg_ratelimited("packet error\n");
 			net_dbg_ratelimited("packet error\n");
 			priv->stats.rx_dropped++;
 			priv->stats.rx_dropped++;
 			priv->stats.rx_errors++;
 			priv->stats.rx_errors++;
-			continue;
+			goto rx_next;
 		}
 		}
 
 
 		len = desc0 & RX_DESC0_FRAME_LEN_MASK;
 		len = desc0 & RX_DESC0_FRAME_LEN_MASK;
@@ -235,6 +235,7 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
 			net_dbg_ratelimited("netdev_alloc_skb_ip_align failed\n");
 			net_dbg_ratelimited("netdev_alloc_skb_ip_align failed\n");
 			priv->stats.rx_dropped++;
 			priv->stats.rx_dropped++;
 			priv->stats.rx_errors++;
 			priv->stats.rx_errors++;
+			goto rx_next;
 		}
 		}
 
 
 		memcpy(skb->data, priv->rx_buf[rx_head], len);
 		memcpy(skb->data, priv->rx_buf[rx_head], len);
@@ -249,18 +250,15 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
 		if (desc0 & RX_DESC0_MULTICAST)
 		if (desc0 & RX_DESC0_MULTICAST)
 			priv->stats.multicast++;
 			priv->stats.multicast++;
 
 
+rx_next:
 		writel(RX_DESC0_DMA_OWN, desc + RX_REG_OFFSET_DESC0);
 		writel(RX_DESC0_DMA_OWN, desc + RX_REG_OFFSET_DESC0);
 
 
 		rx_head = RX_NEXT(rx_head);
 		rx_head = RX_NEXT(rx_head);
 		priv->rx_head = rx_head;
 		priv->rx_head = rx_head;
-
-		if (rx >= budget)
-			break;
 	}
 	}
 
 
 	if (rx < budget) {
 	if (rx < budget) {
-		napi_gro_flush(napi, false);
-		__napi_complete(napi);
+		napi_complete(napi);
 	}
 	}
 
 
 	priv->reg_imr |= RPKT_FINISH_M;
 	priv->reg_imr |= RPKT_FINISH_M;