Skip to content

Commit

Permalink
[PATCH] pcnet32: Handle memory allocation failures cleanly when resiz…
Browse files Browse the repository at this point in the history 
…ing tx/rx rings

Fix pcnet32_set_ringparam to handle memory allocation errors without
leaving the adapter in an inoperative state and null pointers waiting to
be dereferenced.

Tested ia32 and ppc64.

Signed-off-by:  Don Fry <brazilnut@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
  • Loading branch information
Don Fry authored and Jeff Garzik committed Jul 5, 2006
1 parent 12fa30f commit 06c8785
Showing 1 changed file with 251 additions and 24 deletions.
275 changes: 251 additions & 24 deletions drivers/net/pcnet32.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,23 @@ static int homepna[MAX_UNITS];

#define PCNET32_TOTAL_SIZE 0x20

#define CSR0 0
#define CSR0_INIT 0x1
#define CSR0_START 0x2
#define CSR0_STOP 0x4
#define CSR0_TXPOLL 0x8
#define CSR0_INTEN 0x40
#define CSR0_IDON 0x0100
#define CSR0_NORMAL (CSR0_START | CSR0_INTEN)
#define PCNET32_INIT_LOW 1
#define PCNET32_INIT_HIGH 2
#define CSR3 3
#define CSR4 4
#define CSR5 5
#define CSR5_SUSPEND 0x0001
#define CSR15 15
#define PCNET32_MC_FILTER 8

/* The PCNET32 Rx and Tx ring descriptors. */
struct pcnet32_rx_head {
u32 base;
Expand Down Expand Up @@ -415,6 +432,219 @@ static struct pcnet32_access pcnet32_dwio = {
.reset = pcnet32_dwio_reset
};

static void pcnet32_netif_stop(struct net_device *dev)
{
dev->trans_start = jiffies;
netif_poll_disable(dev);
netif_tx_disable(dev);
}

static void pcnet32_netif_start(struct net_device *dev)
{
netif_wake_queue(dev);
netif_poll_enable(dev);
}

/*
* Allocate space for the new sized tx ring.
* Free old resources
* Save new resources.
* Any failure keeps old resources.
* Must be called with lp->lock held.
*/
static void pcnet32_realloc_tx_ring(struct net_device *dev,
struct pcnet32_private *lp,
unsigned int size)
{
dma_addr_t new_ring_dma_addr;
dma_addr_t *new_dma_addr_list;
struct pcnet32_tx_head *new_tx_ring;
struct sk_buff **new_skb_list;

pcnet32_purge_tx_ring(dev);

new_tx_ring = pci_alloc_consistent(lp->pci_dev,
sizeof(struct pcnet32_tx_head) *
(1 << size),
&new_ring_dma_addr);
if (new_tx_ring == NULL) {
if (netif_msg_drv(lp))
printk("\n" KERN_ERR
"%s: Consistent memory allocation failed.\n",
dev->name);
return;
}
memset(new_tx_ring, 0, sizeof(struct pcnet32_tx_head) * (1 << size));

new_dma_addr_list = kcalloc((1 << size), sizeof(dma_addr_t),
GFP_ATOMIC);
if (!new_dma_addr_list) {
if (netif_msg_drv(lp))
printk("\n" KERN_ERR
"%s: Memory allocation failed.\n", dev->name);
goto free_new_tx_ring;
}

new_skb_list = kcalloc((1 << size), sizeof(struct sk_buff *),
GFP_ATOMIC);
if (!new_skb_list) {
if (netif_msg_drv(lp))
printk("\n" KERN_ERR
"%s: Memory allocation failed.\n", dev->name);
goto free_new_lists;
}

kfree(lp->tx_skbuff);
kfree(lp->tx_dma_addr);
pci_free_consistent(lp->pci_dev,
sizeof(struct pcnet32_tx_head) *
lp->tx_ring_size, lp->tx_ring,
lp->tx_ring_dma_addr);

lp->tx_ring_size = (1 << size);
lp->tx_mod_mask = lp->tx_ring_size - 1;
lp->tx_len_bits = (size << 12);
lp->tx_ring = new_tx_ring;
lp->tx_ring_dma_addr = new_ring_dma_addr;
lp->tx_dma_addr = new_dma_addr_list;
lp->tx_skbuff = new_skb_list;
return;

free_new_lists:
kfree(new_dma_addr_list);
free_new_tx_ring:
pci_free_consistent(lp->pci_dev,
sizeof(struct pcnet32_tx_head) *
(1 << size),
new_tx_ring,
new_ring_dma_addr);
return;
}

/*
* Allocate space for the new sized rx ring.
* Re-use old receive buffers.
* alloc extra buffers
* free unneeded buffers
* free unneeded buffers
* Save new resources.
* Any failure keeps old resources.
* Must be called with lp->lock held.
*/
static void pcnet32_realloc_rx_ring(struct net_device *dev,
struct pcnet32_private *lp,
unsigned int size)
{
dma_addr_t new_ring_dma_addr;
dma_addr_t *new_dma_addr_list;
struct pcnet32_rx_head *new_rx_ring;
struct sk_buff **new_skb_list;
int new, overlap;

new_rx_ring = pci_alloc_consistent(lp->pci_dev,
sizeof(struct pcnet32_rx_head) *
(1 << size),
&new_ring_dma_addr);
if (new_rx_ring == NULL) {
if (netif_msg_drv(lp))
printk("\n" KERN_ERR
"%s: Consistent memory allocation failed.\n",
dev->name);
return;
}
memset(new_rx_ring, 0, sizeof(struct pcnet32_rx_head) * (1 << size));

new_dma_addr_list = kcalloc((1 << size), sizeof(dma_addr_t),
GFP_ATOMIC);
if (!new_dma_addr_list) {
if (netif_msg_drv(lp))
printk("\n" KERN_ERR
"%s: Memory allocation failed.\n", dev->name);
goto free_new_rx_ring;
}

new_skb_list = kcalloc((1 << size), sizeof(struct sk_buff *),
GFP_ATOMIC);
if (!new_skb_list) {
if (netif_msg_drv(lp))
printk("\n" KERN_ERR
"%s: Memory allocation failed.\n", dev->name);
goto free_new_lists;
}

/* first copy the current receive buffers */
overlap = min(size, lp->rx_ring_size);
for (new = 0; new < overlap; new++) {
new_rx_ring[new] = lp->rx_ring[new];
new_dma_addr_list[new] = lp->rx_dma_addr[new];
new_skb_list[new] = lp->rx_skbuff[new];
}
/* now allocate any new buffers needed */
for (; new < size; new++ ) {
struct sk_buff *rx_skbuff;
new_skb_list[new] = dev_alloc_skb(PKT_BUF_SZ);
if (!(rx_skbuff = new_skb_list[new])) {
/* keep the original lists and buffers */
if (netif_msg_drv(lp))
printk(KERN_ERR
"%s: pcnet32_realloc_rx_ring dev_alloc_skb failed.\n",
dev->name);
goto free_all_new;
}
skb_reserve(rx_skbuff, 2);

new_dma_addr_list[new] =
pci_map_single(lp->pci_dev, rx_skbuff->data,
PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
new_rx_ring[new].base = (u32) le32_to_cpu(new_dma_addr_list[new]);
new_rx_ring[new].buf_length = le16_to_cpu(2 - PKT_BUF_SZ);
new_rx_ring[new].status = le16_to_cpu(0x8000);
}
/* and free any unneeded buffers */
for (; new < lp->rx_ring_size; new++) {
if (lp->rx_skbuff[new]) {
pci_unmap_single(lp->pci_dev, lp->rx_dma_addr[new],
PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
dev_kfree_skb(lp->rx_skbuff[new]);
}
}

kfree(lp->rx_skbuff);
kfree(lp->rx_dma_addr);
pci_free_consistent(lp->pci_dev,
sizeof(struct pcnet32_rx_head) *
lp->rx_ring_size, lp->rx_ring,
lp->rx_ring_dma_addr);

lp->rx_ring_size = (1 << size);
lp->rx_mod_mask = lp->rx_ring_size - 1;
lp->rx_len_bits = (size << 4);
lp->rx_ring = new_rx_ring;
lp->rx_ring_dma_addr = new_ring_dma_addr;
lp->rx_dma_addr = new_dma_addr_list;
lp->rx_skbuff = new_skb_list;
return;

free_all_new:
for (; --new >= lp->rx_ring_size; ) {
if (new_skb_list[new]) {
pci_unmap_single(lp->pci_dev, new_dma_addr_list[new],
PKT_BUF_SZ - 2, PCI_DMA_FROMDEVICE);
dev_kfree_skb(new_skb_list[new]);
}
}
kfree(new_skb_list);
free_new_lists:
kfree(new_dma_addr_list);
free_new_rx_ring:
pci_free_consistent(lp->pci_dev,
sizeof(struct pcnet32_rx_head) *
(1 << size),
new_rx_ring,
new_ring_dma_addr);
return;
}

#ifdef CONFIG_NET_POLL_CONTROLLER
static void pcnet32_poll_controller(struct net_device *dev)
{
Expand Down Expand Up @@ -526,56 +756,53 @@ static int pcnet32_set_ringparam(struct net_device *dev,
{
struct pcnet32_private *lp = dev->priv;
unsigned long flags;
unsigned int size;
ulong ioaddr = dev->base_addr;
int i;

if (ering->rx_mini_pending || ering->rx_jumbo_pending)
return -EINVAL;

if (netif_running(dev))
pcnet32_close(dev);
pcnet32_netif_stop(dev);

spin_lock_irqsave(&lp->lock, flags);
pcnet32_free_ring(dev);
lp->tx_ring_size =
min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
lp->rx_ring_size =
min(ering->rx_pending, (unsigned int)RX_MAX_RING_SIZE);
lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */

size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);

/* set the minimum ring size to 4, to allow the loopback test to work
* unchanged.
*/
for (i = 2; i <= PCNET32_LOG_MAX_TX_BUFFERS; i++) {
if (lp->tx_ring_size <= (1 << i))
if (size <= (1 << i))
break;
}
lp->tx_ring_size = (1 << i);
lp->tx_mod_mask = lp->tx_ring_size - 1;
lp->tx_len_bits = (i << 12);

if ((1 << i) != lp->tx_ring_size)
pcnet32_realloc_tx_ring(dev, lp, i);

size = min(ering->rx_pending, (unsigned int)RX_MAX_RING_SIZE);
for (i = 2; i <= PCNET32_LOG_MAX_RX_BUFFERS; i++) {
if (lp->rx_ring_size <= (1 << i))
if (size <= (1 << i))
break;
}
lp->rx_ring_size = (1 << i);
lp->rx_mod_mask = lp->rx_ring_size - 1;
lp->rx_len_bits = (i << 4);
if ((1 << i) != lp->rx_ring_size)
pcnet32_realloc_rx_ring(dev, lp, i);

dev->weight = lp->rx_ring_size / 2;

if (pcnet32_alloc_ring(dev, dev->name)) {
pcnet32_free_ring(dev);
spin_unlock_irqrestore(&lp->lock, flags);
return -ENOMEM;
if (netif_running(dev)) {
pcnet32_netif_start(dev);
pcnet32_restart(dev, CSR0_NORMAL);
}

spin_unlock_irqrestore(&lp->lock, flags);

if (pcnet32_debug & NETIF_MSG_DRV)
printk(KERN_INFO PFX
if (netif_msg_drv(lp))
printk(KERN_INFO
"%s: Ring Param Settings: RX: %d, TX: %d\n", dev->name,
lp->rx_ring_size, lp->tx_ring_size);

if (netif_running(dev))
pcnet32_open(dev);

return 0;
}

Expand Down

0 comments on commit 06c8785

Please sign in to comment.