ia64/xen-unstable

changeset 10342:2dea01abfbfe

[NET] front: There's a small leak on a couple error paths in setup_device().
While there rearrange the ring setup order slightly to simplify error
path since netif_free() will cleanup once ring_ref is valid. And use
get_zeroed_page() instead of __get_free_page()/memset(). Handle error if
bind_evtchn_to_irqhandler() fails, as bad info->irq value is likely to
cause oops later. In create_device(), gnttab_free_grant_references()
is accidentally called twice on tx_head during cleanup from failed
gnttab_alloc_grant_references() on rx_head, which could corrupt
gnttab_free_count.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
author kaf24@firebug.cl.cam.ac.uk
date Fri Jun 09 14:10:32 2006 +0100 (2006-06-09)
parents 68c22a722e6f
children afdb70b16a53
files linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
line diff
     1.1 --- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c	Fri Jun 09 08:15:58 2006 +0100
     1.2 +++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c	Fri Jun 09 14:10:32 2006 +0100
     1.3 @@ -338,35 +338,36 @@ static int setup_device(struct xenbus_de
     1.4  	info->tx.sring = NULL;
     1.5  	info->irq = 0;
     1.6  
     1.7 -	txs = (struct netif_tx_sring *)__get_free_page(GFP_KERNEL);
     1.8 +	txs = (struct netif_tx_sring *)get_zeroed_page(GFP_KERNEL);
     1.9  	if (!txs) {
    1.10  		err = -ENOMEM;
    1.11  		xenbus_dev_fatal(dev, err, "allocating tx ring page");
    1.12  		goto fail;
    1.13  	}
    1.14 -	rxs = (struct netif_rx_sring *)__get_free_page(GFP_KERNEL);
    1.15 +	SHARED_RING_INIT(txs);
    1.16 +	FRONT_RING_INIT(&info->tx, txs, PAGE_SIZE);
    1.17 +
    1.18 +	err = xenbus_grant_ring(dev, virt_to_mfn(txs));
    1.19 +	if (err < 0) {
    1.20 +		free_page((unsigned long)txs);
    1.21 +		goto fail;
    1.22 +	}
    1.23 +	info->tx_ring_ref = err;
    1.24 +
    1.25 +	rxs = (struct netif_rx_sring *)get_zeroed_page(GFP_KERNEL);
    1.26  	if (!rxs) {
    1.27  		err = -ENOMEM;
    1.28  		xenbus_dev_fatal(dev, err, "allocating rx ring page");
    1.29  		goto fail;
    1.30  	}
    1.31 -	memset(txs, 0, PAGE_SIZE);
    1.32 -	memset(rxs, 0, PAGE_SIZE);
    1.33 -
    1.34 -	SHARED_RING_INIT(txs);
    1.35 -	FRONT_RING_INIT(&info->tx, txs, PAGE_SIZE);
    1.36 -
    1.37  	SHARED_RING_INIT(rxs);
    1.38  	FRONT_RING_INIT(&info->rx, rxs, PAGE_SIZE);
    1.39  
    1.40 -	err = xenbus_grant_ring(dev, virt_to_mfn(txs));
    1.41 -	if (err < 0)
    1.42 +	err = xenbus_grant_ring(dev, virt_to_mfn(rxs));
    1.43 +	if (err < 0) {
    1.44 +		free_page((unsigned long)rxs);
    1.45  		goto fail;
    1.46 -	info->tx_ring_ref = err;
    1.47 -
    1.48 -	err = xenbus_grant_ring(dev, virt_to_mfn(rxs));
    1.49 -	if (err < 0)
    1.50 -		goto fail;
    1.51 +	}
    1.52  	info->rx_ring_ref = err;
    1.53  
    1.54  	err = xenbus_alloc_evtchn(dev, &info->evtchn);
    1.55 @@ -374,10 +375,11 @@ static int setup_device(struct xenbus_de
    1.56  		goto fail;
    1.57  
    1.58  	memcpy(netdev->dev_addr, info->mac, ETH_ALEN);
    1.59 -	info->irq = bind_evtchn_to_irqhandler(
    1.60 -		info->evtchn, netif_int, SA_SAMPLE_RANDOM, netdev->name,
    1.61 -		netdev);
    1.62 -
    1.63 +	err = bind_evtchn_to_irqhandler(info->evtchn, netif_int,
    1.64 +					SA_SAMPLE_RANDOM, netdev->name, netdev);
    1.65 +	if (err < 0)
    1.66 +		goto fail;
    1.67 +	info->irq = err;
    1.68  	return 0;
    1.69  
    1.70   fail:
    1.71 @@ -1397,7 +1399,6 @@ static struct net_device * __devinit cre
    1.72  	if (gnttab_alloc_grant_references(RX_MAX_TARGET,
    1.73  					  &np->gref_rx_head) < 0) {
    1.74  		printk(KERN_ALERT "#### netfront can't alloc rx grant refs\n");
    1.75 -		gnttab_free_grant_references(np->gref_tx_head);
    1.76  		err = -ENOMEM;
    1.77  		goto exit_free_tx;
    1.78  	}