summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2009-06-12 03:00:35 +0000
committerDavid S. Miller <davem@davemloft.net>2009-06-13 01:18:32 -0700
commit3790c8cdb99f23824b23cb16df608281b335ee91 (patch)
treec437f801a709cefcf1210eb1e9f8306e52f42ca6
parentda6782927de809d9d427bd4bd6a4024243e41f13 (diff)
downloadlinux-3790c8cdb99f23824b23cb16df608281b335ee91.tar.bz2
net: fix network driver ndo_start_xmit() return values (part 1)
Fix up drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning and requeue/retransmit the skb. - xpnet: memory allocation error, intention is to drop - ethoc: oversized packet, packet must be dropped - ibmlana: skb freed: use after free - rrunner: skb freed: use after free Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/misc/sgi-xp/xpnet.c3
-rw-r--r--drivers/net/ethoc.c6
-rw-r--r--drivers/net/ibmlana.c5
-rw-r--r--drivers/net/rrunner.c2
4 files changed, 8 insertions, 8 deletions
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 6faefcffcb53..8d1c60a3f0df 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -450,7 +450,8 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
"packet\n", sizeof(struct xpnet_pending_msg));
dev->stats.tx_errors++;
- return -ENOMEM;
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
}
/* get the beginning of the first cacheline and end of last */
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index 91a9b1a33764..ceb6a9c357ad 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -811,7 +811,7 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
if (unlikely(skb->len > ETHOC_BUFSIZ)) {
priv->stats.tx_errors++;
- return -EMSGSIZE;
+ goto out;
}
entry = priv->cur_tx % priv->num_tx;
@@ -840,9 +840,9 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
}
dev->trans_start = jiffies;
- dev_kfree_skb(skb);
-
spin_unlock_irq(&priv->lock);
+out:
+ dev_kfree_skb(skb);
return NETDEV_TX_OK;
}
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index c25bc0bc0b25..448098d3b39b 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -815,7 +815,7 @@ static int ibmlana_close(struct net_device *dev)
static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)
{
ibmlana_priv *priv = netdev_priv(dev);
- int retval = 0, tmplen, addr;
+ int tmplen, addr;
unsigned long flags;
tda_t tda;
int baddr;
@@ -824,7 +824,6 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)
the upper layer is in deep desperation and we simply ignore the frame. */
if (priv->txusedcnt >= TXBUFCNT) {
- retval = -EIO;
dev->stats.tx_dropped++;
goto tx_done;
}
@@ -874,7 +873,7 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)
spin_unlock_irqrestore(&priv->lock, flags);
tx_done:
dev_kfree_skb(skb);
- return retval;
+ return NETDEV_TX_OK;
}
/* switch receiver mode. */
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index d890829a9acc..81dbcbb910f4 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -1425,7 +1425,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
if (!(new_skb = dev_alloc_skb(len + 8))) {
dev_kfree_skb(skb);
netif_wake_queue(dev);
- return -EBUSY;
+ return NETDEV_TX_OK;
}
skb_reserve(new_skb, 8);
skb_put(new_skb, len);