From 3790c8cdb99f23824b23cb16df608281b335ee91 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Fri, 12 Jun 2009 03:00:35 +0000 Subject: net: fix network driver ndo_start_xmit() return values (part 1) Fix up drivers that return an errno value to qdisc_restart(), causing qdisc_restart() to print a warning and requeue/retransmit the skb. - xpnet: memory allocation error, intention is to drop - ethoc: oversized packet, packet must be dropped - ibmlana: skb freed: use after free - rrunner: skb freed: use after free Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- drivers/misc/sgi-xp/xpnet.c | 3 ++- drivers/net/ethoc.c | 6 +++--- drivers/net/ibmlana.c | 5 ++--- drivers/net/rrunner.c | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) (limited to 'drivers') diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c index 6faefcffcb53..8d1c60a3f0df 100644 --- a/drivers/misc/sgi-xp/xpnet.c +++ b/drivers/misc/sgi-xp/xpnet.c @@ -450,7 +450,8 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) "packet\n", sizeof(struct xpnet_pending_msg)); dev->stats.tx_errors++; - return -ENOMEM; + dev_kfree_skb(skb); + return NETDEV_TX_OK; } /* get the beginning of the first cacheline and end of last */ diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c index 91a9b1a33764..ceb6a9c357ad 100644 --- a/drivers/net/ethoc.c +++ b/drivers/net/ethoc.c @@ -811,7 +811,7 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev) if (unlikely(skb->len > ETHOC_BUFSIZ)) { priv->stats.tx_errors++; - return -EMSGSIZE; + goto out; } entry = priv->cur_tx % priv->num_tx; @@ -840,9 +840,9 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev) } dev->trans_start = jiffies; - dev_kfree_skb(skb); - spin_unlock_irq(&priv->lock); +out: + dev_kfree_skb(skb); return NETDEV_TX_OK; } diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c index c25bc0bc0b25..448098d3b39b 100644 --- a/drivers/net/ibmlana.c +++ b/drivers/net/ibmlana.c @@ -815,7 +815,7 @@ static int ibmlana_close(struct net_device *dev) static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) { ibmlana_priv *priv = netdev_priv(dev); - int retval = 0, tmplen, addr; + int tmplen, addr; unsigned long flags; tda_t tda; int baddr; @@ -824,7 +824,6 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) the upper layer is in deep desperation and we simply ignore the frame. */ if (priv->txusedcnt >= TXBUFCNT) { - retval = -EIO; dev->stats.tx_dropped++; goto tx_done; } @@ -874,7 +873,7 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) spin_unlock_irqrestore(&priv->lock, flags); tx_done: dev_kfree_skb(skb); - return retval; + return NETDEV_TX_OK; } /* switch receiver mode. */ diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c index d890829a9acc..81dbcbb910f4 100644 --- a/drivers/net/rrunner.c +++ b/drivers/net/rrunner.c @@ -1425,7 +1425,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev) if (!(new_skb = dev_alloc_skb(len + 8))) { dev_kfree_skb(skb); netif_wake_queue(dev); - return -EBUSY; + return NETDEV_TX_OK; } skb_reserve(new_skb, 8); skb_put(new_skb, len); -- cgit v1.2.3