The following commit has been merged in the master branch: commit 5515995b54120714acc10888f4d95f27ac472c85 Author: Vasiliy Kulikov segooon@gmail.com Date: Sun Sep 12 19:36:56 2010 +0000

staging: batman-adv: check kmalloc() return value

kmalloc() may fail, if so drop current packet.

Signed-off-by: Vasiliy Kulikov segooon@gmail.com Signed-off-by: Marek Lindner lindner_marek@yahoo.de

diff --git a/routing.c b/routing.c index a2c64a4..e09a231 100644 --- a/routing.c +++ b/routing.c @@ -1244,8 +1244,10 @@ int recv_ucast_frag_packet(struct sk_buff *skb, struct batman_if *recv_if)

orig_node->last_frag_packet = jiffies;

- if (list_empty(&orig_node->frag_list)) - create_frag_buffer(&orig_node->frag_list); + if (list_empty(&orig_node->frag_list)) { + if (create_frag_buffer(&orig_node->frag_list)) + return NET_RX_DROP; + }

tmp_frag_entry = search_frag_packet(&orig_node->frag_list, diff --git a/unicast.c b/unicast.c index 84b204b..ee85c7c 100644 --- a/unicast.c +++ b/unicast.c @@ -79,7 +79,7 @@ void create_frag_entry(struct list_head *head, struct sk_buff *skb) return; }

-void create_frag_buffer(struct list_head *head) +int create_frag_buffer(struct list_head *head) { int i; struct frag_packet_list_entry *tfp; @@ -87,13 +87,17 @@ void create_frag_buffer(struct list_head *head) for (i = 0; i < FRAG_BUFFER_SIZE; i++) { tfp = kmalloc(sizeof(struct frag_packet_list_entry), GFP_ATOMIC); + if (!tfp) { + frag_list_free(head); + return -ENOMEM; + } tfp->skb = NULL; tfp->seqno = 0; INIT_LIST_HEAD(&tfp->list); list_add(&tfp->list, head); }

- return; + return 0; }

struct frag_packet_list_entry *search_frag_packet(struct list_head *head, diff --git a/unicast.h b/unicast.h index 1d5cbeb..7973697 100644 --- a/unicast.h +++ b/unicast.h @@ -30,7 +30,7 @@ struct sk_buff *merge_frag_packet(struct list_head *head, struct sk_buff *skb);

void create_frag_entry(struct list_head *head, struct sk_buff *skb); -void create_frag_buffer(struct list_head *head); +int create_frag_buffer(struct list_head *head); struct frag_packet_list_entry *search_frag_packet(struct list_head *head, struct unicast_frag_packet *up); void frag_list_free(struct list_head *head);