We have discovered a problem in the eepro100 driver when a system cannot
allocate an skbuff. In speedo_init_rx_ring() and speedo_rx_alloc() the
is a call to dev_alloc_skb() followed by an rx_align(). On multiple
platforms, rx_align() is a macro to skb_reserve((skb), 2). If the
argument (skb) is NULL, an Oops will occur. If dev_alloc_skb() returns
with a valid address (non-NULL), then it needs to be aligned prior to
filling in the buffer field. If dev_alloc_skb() returns NULL, then NULL
needs to be used when filling in the buffer field.
Attached is a proposed patch to check the value returned from
dev_alloc_skb() prior to using rx_align().
Charlie Brett / Hewlett Packard LOSL
diff -urN linux/drivers/net/eepro100.c linux/drivers/net/eepro100.c.new
--- linux/drivers/net/eepro100.c Mon Aug 9 19:46:39 2004
+++ linux/drivers/net/eepro100.c.new Tue Nov 23 16:07:55 2004
@@ -1280,8 +1280,8 @@
for (i = 0; i < RX_RING_SIZE; i++) {
struct sk_buff *skb;
skb = dev_alloc_skb(PKT_BUF_SZ + sizeof(struct RxFD));
- /* XXX: do we really want to call this before the NULL
check? --hch */
- rx_align(skb); /* Align IP on 16 byte
boundary */
+ if (skb)
+ rx_align(skb); /* Align IP on 16 byte
boundary */
sp->rx_skbuff[i] = skb;
if (skb == NULL)
break; /* OK. Just initially
short of Rx bufs. */
@@ -1668,8 +1668,8 @@
struct sk_buff *skb;
/* Get a fresh skbuff to replace the consumed one. */
skb = dev_alloc_skb(PKT_BUF_SZ + sizeof(struct RxFD));
- /* XXX: do we really want to call this before the NULL check?
--hch */
- rx_align(skb); /* Align IP on 16 byte
boundary */
+ if (skb)
+ rx_align(skb); /* Align IP on 16 byte
boundary */
sp->rx_skbuff[entry] = skb;
if (skb == NULL) {
sp->rx_ringp[entry] = NULL;
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
