Commit 3790c8cd authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

net: fix network driver ndo_start_xmit() return values (part 1)

Fix up drivers that return an errno value to qdisc_restart(), causing
qdisc_restart() to print a warning and requeue/retransmit the skb.

- xpnet: memory allocation error, intention is to drop
- ethoc: oversized packet, packet must be dropped
- ibmlana: skb freed: use after free
- rrunner: skb freed: use after free
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent da678292
...@@ -450,7 +450,8 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -450,7 +450,8 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
"packet\n", sizeof(struct xpnet_pending_msg)); "packet\n", sizeof(struct xpnet_pending_msg));
dev->stats.tx_errors++; dev->stats.tx_errors++;
return -ENOMEM; dev_kfree_skb(skb);
return NETDEV_TX_OK;
} }
/* get the beginning of the first cacheline and end of last */ /* get the beginning of the first cacheline and end of last */
......
...@@ -811,7 +811,7 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -811,7 +811,7 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
if (unlikely(skb->len > ETHOC_BUFSIZ)) { if (unlikely(skb->len > ETHOC_BUFSIZ)) {
priv->stats.tx_errors++; priv->stats.tx_errors++;
return -EMSGSIZE; goto out;
} }
entry = priv->cur_tx % priv->num_tx; entry = priv->cur_tx % priv->num_tx;
...@@ -840,9 +840,9 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -840,9 +840,9 @@ static int ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
} }
dev->trans_start = jiffies; dev->trans_start = jiffies;
dev_kfree_skb(skb);
spin_unlock_irq(&priv->lock); spin_unlock_irq(&priv->lock);
out:
dev_kfree_skb(skb);
return NETDEV_TX_OK; return NETDEV_TX_OK;
} }
......
...@@ -815,7 +815,7 @@ static int ibmlana_close(struct net_device *dev) ...@@ -815,7 +815,7 @@ static int ibmlana_close(struct net_device *dev)
static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)
{ {
ibmlana_priv *priv = netdev_priv(dev); ibmlana_priv *priv = netdev_priv(dev);
int retval = 0, tmplen, addr; int tmplen, addr;
unsigned long flags; unsigned long flags;
tda_t tda; tda_t tda;
int baddr; int baddr;
...@@ -824,7 +824,6 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) ...@@ -824,7 +824,6 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)
the upper layer is in deep desperation and we simply ignore the frame. */ the upper layer is in deep desperation and we simply ignore the frame. */
if (priv->txusedcnt >= TXBUFCNT) { if (priv->txusedcnt >= TXBUFCNT) {
retval = -EIO;
dev->stats.tx_dropped++; dev->stats.tx_dropped++;
goto tx_done; goto tx_done;
} }
...@@ -874,7 +873,7 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev) ...@@ -874,7 +873,7 @@ static int ibmlana_tx(struct sk_buff *skb, struct net_device *dev)
spin_unlock_irqrestore(&priv->lock, flags); spin_unlock_irqrestore(&priv->lock, flags);
tx_done: tx_done:
dev_kfree_skb(skb); dev_kfree_skb(skb);
return retval; return NETDEV_TX_OK;
} }
/* switch receiver mode. */ /* switch receiver mode. */
......
...@@ -1425,7 +1425,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -1425,7 +1425,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
if (!(new_skb = dev_alloc_skb(len + 8))) { if (!(new_skb = dev_alloc_skb(len + 8))) {
dev_kfree_skb(skb); dev_kfree_skb(skb);
netif_wake_queue(dev); netif_wake_queue(dev);
return -EBUSY; return NETDEV_TX_OK;
} }
skb_reserve(new_skb, 8); skb_reserve(new_skb, 8);
skb_put(new_skb, len); skb_put(new_skb, len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment