[Xen-changelog] [xen-unstable] [NET] front: There's a small leak on a couple error paths in setup_device().

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kaf24@xxxxxxxxxxxxxxxxxxxx
# Node ID 2dea01abfbfebef422f249a64746c9182696b4db
# Parent  68c22a722e6ff1314f9d9653ca010cc9df6a02af
[NET] front: There's a small leak on a couple error paths in setup_device().
While there rearrange the ring setup order slightly to simplify error
path since netif_free() will cleanup once ring_ref is valid.  And use
get_zeroed_page() instead of __get_free_page()/memset().  Handle error if
bind_evtchn_to_irqhandler() fails, as bad info->irq value is likely to
cause oops later.  In create_device(), gnttab_free_grant_references()
is accidentally called twice on tx_head during cleanup from failed
gnttab_alloc_grant_references() on rx_head, which could corrupt
gnttab_free_count.

Signed-off-by: Chris Wright <chrisw@xxxxxxxxxxxx>
---
 linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c |   41 +++++++++----------
 1 files changed, 21 insertions(+), 20 deletions(-)

diff -r 68c22a722e6f -r 2dea01abfbfe 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Fri Jun 09 
08:15:58 2006 +0100
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Fri Jun 09 
14:10:32 2006 +0100
@@ -338,35 +338,36 @@ static int setup_device(struct xenbus_de
        info->tx.sring = NULL;
        info->irq = 0;
 
-       txs = (struct netif_tx_sring *)__get_free_page(GFP_KERNEL);
+       txs = (struct netif_tx_sring *)get_zeroed_page(GFP_KERNEL);
        if (!txs) {
                err = -ENOMEM;
                xenbus_dev_fatal(dev, err, "allocating tx ring page");
                goto fail;
        }
-       rxs = (struct netif_rx_sring *)__get_free_page(GFP_KERNEL);
+       SHARED_RING_INIT(txs);
+       FRONT_RING_INIT(&info->tx, txs, PAGE_SIZE);
+
+       err = xenbus_grant_ring(dev, virt_to_mfn(txs));
+       if (err < 0) {
+               free_page((unsigned long)txs);
+               goto fail;
+       }
+       info->tx_ring_ref = err;
+
+       rxs = (struct netif_rx_sring *)get_zeroed_page(GFP_KERNEL);
        if (!rxs) {
                err = -ENOMEM;
                xenbus_dev_fatal(dev, err, "allocating rx ring page");
                goto fail;
        }
-       memset(txs, 0, PAGE_SIZE);
-       memset(rxs, 0, PAGE_SIZE);
-
-       SHARED_RING_INIT(txs);
-       FRONT_RING_INIT(&info->tx, txs, PAGE_SIZE);
-
        SHARED_RING_INIT(rxs);
        FRONT_RING_INIT(&info->rx, rxs, PAGE_SIZE);
 
-       err = xenbus_grant_ring(dev, virt_to_mfn(txs));
-       if (err < 0)
+       err = xenbus_grant_ring(dev, virt_to_mfn(rxs));
+       if (err < 0) {
+               free_page((unsigned long)rxs);
                goto fail;
-       info->tx_ring_ref = err;
-
-       err = xenbus_grant_ring(dev, virt_to_mfn(rxs));
-       if (err < 0)
-               goto fail;
+       }
        info->rx_ring_ref = err;
 
        err = xenbus_alloc_evtchn(dev, &info->evtchn);
@@ -374,10 +375,11 @@ static int setup_device(struct xenbus_de
                goto fail;
 
        memcpy(netdev->dev_addr, info->mac, ETH_ALEN);
-       info->irq = bind_evtchn_to_irqhandler(
-               info->evtchn, netif_int, SA_SAMPLE_RANDOM, netdev->name,
-               netdev);
-
+       err = bind_evtchn_to_irqhandler(info->evtchn, netif_int,
+                                       SA_SAMPLE_RANDOM, netdev->name, netdev);
+       if (err < 0)
+               goto fail;
+       info->irq = err;
        return 0;
 
  fail:
@@ -1397,7 +1399,6 @@ static struct net_device * __devinit cre
        if (gnttab_alloc_grant_references(RX_MAX_TARGET,
                                          &np->gref_rx_head) < 0) {
                printk(KERN_ALERT "#### netfront can't alloc rx grant refs\n");
-               gnttab_free_grant_references(np->gref_tx_head);
                err = -ENOMEM;
                goto exit_free_tx;
        }

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog