Skip to contentSkip to conversation

S2io: fixes in free_shared_mem function

PATCH Applied Koushik 3 participants 3 messages Nov 18, 2004 – Jan 7, 2005

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Koushik

author
#0 lore raw

PATCH 1/1 S2io: fixes in free_shared_mem function

Hello All,
As per KK's review comment received on Nov 8 about the free_shared_mem function, Iam sending the following patch.

The change log includes:

1. Break from the main 'for loop' if ba[i] is NULL.

2. In the second level 'for loop', if ba[i][j] is NULL, instead of continuing as was done previously, we now free the ba[i] pointer and break from the main 'for loop'.

3. In the 'while loop' inside the second tier 'for loop', if any of the three pointers (ba or ba->ba_0_org or ba->ba_1_org) is found to be NULL, then ba[i], ba[i][j] and the non NULL buffer pointer if any (ba_0_org or ba_1_org) is freed and break from the main 'for loop'.

Signed-off-by Koushik <[email protected]>
Signed-off-by Ravi <[email protected]>

---

drivers/net/s2io.c +18 -4
diff -urN vanilla_linux/drivers/net/s2io.c linux-2.6.8.1/drivers/net/s2io.c
@@ -560,21 +560,35 @@
 	for (i = 0; i < config->rx_ring_num; i++) {
 		blk_cnt =
 		    config->rx_cfg[i].num_rxd / (MAX_RXDS_PER_BLOCK + 1);
+		if (!nic->ba[i])
+			goto end_free;
 		for (j = 0; j < blk_cnt; j++) {
 			int k = 0;
-			if (!nic->ba[i][j])
-				continue;
+			if (!nic->ba[i][j]) {
+				kfree(nic->ba[i]);
+				goto end_free;
+			}
 			while (k != MAX_RXDS_PER_BLOCK) {
 				buffAdd_t *ba = &nic->ba[i][j][k];
+				if (!ba || !ba->ba_0_org || !ba->ba_1_org)
+				{
+					kfree(nic->ba[i]);
+					kfree(nic->ba[i][j]);
+					if(ba->ba_0_org)
+						kfree(ba->ba_0_org);
+					if(ba->ba_1_org)
+						kfree(ba->ba_1_org);
+					goto end_free;
+				}
 				kfree(ba->ba_0_org);
 				kfree(ba->ba_1_org);
 				k++;
 			}
 			kfree(nic->ba[i][j]);
 		}
-		if (nic->ba[i])
-			kfree(nic->ba[i]);
+		kfree(nic->ba[i]);
 	}
+end_free:
 #endif
 
 	if (mac_control->stats_mem) {
#1 lore raw

Hi KK,
Does this patch look okay ? Does it address your earlier comments ?

Thanks,
Ravi

-----Original Message-----
From: Koushik [mailto:[email protected]]
Sent: Thursday, November 18, 2004 1:35 PM
To: [email protected]; [email protected]; [email protected]
Cc: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]
Subject: [PATCH 2.6.9-rc2 1/1] S2io: fixes in free_shared_mem function

Hello All,
As per KK's review comment received on Nov 8 about the free_shared_mem function, Iam sending the following patch.

The change log includes:

1. Break from the main 'for loop' if ba[i] is NULL.

2. In the second level 'for loop', if ba[i][j] is NULL, instead of continuing as was done previously, we now free the ba[i] pointer and break from the main 'for loop'.

3. In the 'while loop' inside the second tier 'for loop', if any of the three pointers (ba or ba->ba_0_org or ba->ba_1_org) is found to be NULL, then ba[i], ba[i][j] and the non NULL buffer pointer if any (ba_0_org or ba_1_org) is freed and break from the main 'for loop'.

Signed-off-by Koushik <[email protected]>
Signed-off-by Ravi <[email protected]>

---

drivers/net/s2io.c +18 -4
diff -urN vanilla_linux/drivers/net/s2io.c linux-2.6.8.1/drivers/net/s2io.c
@@ -560,21 +560,35 @@
 	for (i = 0; i < config->rx_ring_num; i++) {
 		blk_cnt =
 		    config->rx_cfg[i].num_rxd / (MAX_RXDS_PER_BLOCK + 1);
+		if (!nic->ba[i])
+			goto end_free;
 		for (j = 0; j < blk_cnt; j++) {
 			int k = 0;
-			if (!nic->ba[i][j])
-				continue;
+			if (!nic->ba[i][j]) {
+				kfree(nic->ba[i]);
+				goto end_free;
+			}
 			while (k != MAX_RXDS_PER_BLOCK) {
 				buffAdd_t *ba = &nic->ba[i][j][k];
+				if (!ba || !ba->ba_0_org || !ba->ba_1_org)
+				{
+					kfree(nic->ba[i]);
+					kfree(nic->ba[i][j]);
+					if(ba->ba_0_org)
+						kfree(ba->ba_0_org);
+					if(ba->ba_1_org)
+						kfree(ba->ba_1_org);
+					goto end_free;
+				}
 				kfree(ba->ba_0_org);
 				kfree(ba->ba_1_org);
 				k++;
 			}
 			kfree(nic->ba[i][j]);
 		}
-		if (nic->ba[i])
-			kfree(nic->ba[i]);
+		kfree(nic->ba[i]);
 	}
+end_free:
 #endif
 
 	if (mac_control->stats_mem) {