[5/5] Staging: batman-adv: check kmalloc() return value
Commit Message
From: Vasiliy Kulikov <segooon@gmail.com>
kmalloc() may fail, if so drop current packet.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
[sven.eckelmann@gmx.de: Removed new introduced deadlock]
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
drivers/staging/batman-adv/routing.c | 8 ++++++--
drivers/staging/batman-adv/unicast.c | 8 ++++++--
drivers/staging/batman-adv/unicast.h | 2 +-
3 files changed, 13 insertions(+), 5 deletions(-)
@@ -1232,8 +1232,12 @@ int recv_ucast_frag_packet(struct sk_buff *skb, struct batman_if *recv_if)
orig_node->last_frag_packet = jiffies;
- if (list_empty(&orig_node->frag_list))
- create_frag_buffer(&orig_node->frag_list);
+ if (list_empty(&orig_node->frag_list) &&
+ create_frag_buffer(&orig_node->frag_list)) {
+ spin_unlock_irqrestore(&bat_priv->orig_hash_lock,
+ flags);
+ return NET_RX_DROP;
+ }
tmp_frag_entry =
search_frag_packet(&orig_node->frag_list,
@@ -78,7 +78,7 @@ void create_frag_entry(struct list_head *head, struct sk_buff *skb)
return;
}
-void create_frag_buffer(struct list_head *head)
+int create_frag_buffer(struct list_head *head)
{
int i;
struct frag_packet_list_entry *tfp;
@@ -86,13 +86,17 @@ void create_frag_buffer(struct list_head *head)
for (i = 0; i < FRAG_BUFFER_SIZE; i++) {
tfp = kmalloc(sizeof(struct frag_packet_list_entry),
GFP_ATOMIC);
+ if (!tfp) {
+ frag_list_free(head);
+ return -ENOMEM;
+ }
tfp->skb = NULL;
tfp->seqno = 0;
INIT_LIST_HEAD(&tfp->list);
list_add(&tfp->list, head);
}
- return;
+ return 0;
}
struct frag_packet_list_entry *search_frag_packet(struct list_head *head,
@@ -30,7 +30,7 @@ struct sk_buff *merge_frag_packet(struct list_head *head,
struct sk_buff *skb);
void create_frag_entry(struct list_head *head, struct sk_buff *skb);
-void create_frag_buffer(struct list_head *head);
+int create_frag_buffer(struct list_head *head);
struct frag_packet_list_entry *search_frag_packet(struct list_head *head,
struct unicast_frag_packet *up);
void frag_list_free(struct list_head *head);