Commit b1871948 authored by Stephen Hemminger's avatar Stephen Hemminger

[PATCH] sb1000 driver bugs

Inspecting the sb1000 driver showed some interesting bugs:
	- net device pointer is used before the device is allocated; gcc
	  does catch this.
	- unregister is called even though device not registered successfully
	- net device is not freed on remove.

Compiles but don't have hardware to test.  Don't know how it ever worked though.
parent 357ac5cb
...@@ -162,11 +162,18 @@ sb1000_probe_one(struct pnp_dev *pdev, const struct pnp_device_id *id) ...@@ -162,11 +162,18 @@ sb1000_probe_one(struct pnp_dev *pdev, const struct pnp_device_id *id)
irq = pnp_irq(pdev, 0); irq = pnp_irq(pdev, 0);
if (!request_region(ioaddr[0], 16, dev->name)) if (!request_region(ioaddr[0], 16, "sb1000"))
goto out_disable; goto out_disable;
if (!request_region(ioaddr[1], 16, dev->name)) if (!request_region(ioaddr[1], 16, "sb1000"))
goto out_release_region0; goto out_release_region0;
dev = alloc_etherdev(sizeof(struct sb1000_private));
if (!dev) {
error = -ENOMEM;
goto out_release_regions;
}
dev->base_addr = ioaddr[0]; dev->base_addr = ioaddr[0];
/* mem_start holds the second I/O address */ /* mem_start holds the second I/O address */
dev->mem_start = ioaddr[1]; dev->mem_start = ioaddr[1];
...@@ -177,12 +184,6 @@ sb1000_probe_one(struct pnp_dev *pdev, const struct pnp_device_id *id) ...@@ -177,12 +184,6 @@ sb1000_probe_one(struct pnp_dev *pdev, const struct pnp_device_id *id)
"S/N %#8.8x, IRQ %d.\n", dev->name, dev->base_addr, "S/N %#8.8x, IRQ %d.\n", dev->name, dev->base_addr,
dev->mem_start, serial_number, dev->irq); dev->mem_start, serial_number, dev->irq);
dev = alloc_etherdev(sizeof(struct sb1000_private));
if (!dev) {
error = -ENOMEM;
goto out_release_regions;
}
/* /*
* The SB1000 is an rx-only cable modem device. The uplink is a modem * The SB1000 is an rx-only cable modem device. The uplink is a modem
* and we do not want to arp on it. * and we do not want to arp on it.
...@@ -212,11 +213,9 @@ sb1000_probe_one(struct pnp_dev *pdev, const struct pnp_device_id *id) ...@@ -212,11 +213,9 @@ sb1000_probe_one(struct pnp_dev *pdev, const struct pnp_device_id *id)
error = register_netdev(dev); error = register_netdev(dev);
if (error) if (error)
goto out_unregister; goto out_release_regions;
return 0; return 0;
out_unregister:
unregister_netdev(dev);
out_release_regions: out_release_regions:
release_region(ioaddr[1], 16); release_region(ioaddr[1], 16);
out_release_region0: out_release_region0:
...@@ -236,6 +235,7 @@ sb1000_remove_one(struct pnp_dev *pdev) ...@@ -236,6 +235,7 @@ sb1000_remove_one(struct pnp_dev *pdev)
unregister_netdev(dev); unregister_netdev(dev);
release_region(dev->base_addr, 16); release_region(dev->base_addr, 16);
release_region(dev->mem_start, 16); release_region(dev->mem_start, 16);
kfree(dev);
} }
static struct pnp_driver sb1000_driver = { static struct pnp_driver sb1000_driver = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment