aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorKyle McMartin <kyle@redhat.com>2009-03-18 21:49:01 -0400
committerDavid S. Miller <davem@davemloft.net>2009-03-18 21:49:01 -0400
commit69145635d4db0a0382885b14634aa5b721f3aa1a (patch)
tree3221b6a995853fe0a29887c1f83c158477845cd3 /drivers
parent4783256ef92f5aecd6d54693b16386f2a0021c2a (diff)
tulip: fix crash on iface up with shirq debug
Tulip is currently doing request_irq before it has done its initialization. This is usually not a problem because it hasn't enable interrupts yet, but with DEBUG_SHIRQ on, we call the irq handler when registering the interrupt as a sanity check. This can result in a NULL ptr dereference, so call tulip_init_ring before request_irq, and add a free_ring function to do the freeing now shared with tulip_close. Tested with a shell loop running ifup, ifdown in a loop a few hundred times with DEBUG_SHIRQ on. Signed-off-by: Kyle McMartin <kyle@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/tulip/tulip_core.c45
1 files changed, 29 insertions, 16 deletions
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index bee75fa87a9c..2abb5d3becc6 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -255,6 +255,7 @@ const char tulip_media_cap[32] =
255 255
256static void tulip_tx_timeout(struct net_device *dev); 256static void tulip_tx_timeout(struct net_device *dev);
257static void tulip_init_ring(struct net_device *dev); 257static void tulip_init_ring(struct net_device *dev);
258static void tulip_free_ring(struct net_device *dev);
258static int tulip_start_xmit(struct sk_buff *skb, struct net_device *dev); 259static int tulip_start_xmit(struct sk_buff *skb, struct net_device *dev);
259static int tulip_open(struct net_device *dev); 260static int tulip_open(struct net_device *dev);
260static int tulip_close(struct net_device *dev); 261static int tulip_close(struct net_device *dev);
@@ -502,16 +503,21 @@ tulip_open(struct net_device *dev)
502{ 503{
503 int retval; 504 int retval;
504 505
505 if ((retval = request_irq(dev->irq, &tulip_interrupt, IRQF_SHARED, dev->name, dev)))
506 return retval;
507
508 tulip_init_ring (dev); 506 tulip_init_ring (dev);
509 507
508 retval = request_irq(dev->irq, &tulip_interrupt, IRQF_SHARED, dev->name, dev);
509 if (retval)
510 goto free_ring;
511
510 tulip_up (dev); 512 tulip_up (dev);
511 513
512 netif_start_queue (dev); 514 netif_start_queue (dev);
513 515
514 return 0; 516 return 0;
517
518free_ring:
519 tulip_free_ring (dev);
520 return retval;
515} 521}
516 522
517 523
@@ -768,23 +774,11 @@ static void tulip_down (struct net_device *dev)
768 tulip_set_power_state (tp, 0, 1); 774 tulip_set_power_state (tp, 0, 1);
769} 775}
770 776
771 777static void tulip_free_ring (struct net_device *dev)
772static int tulip_close (struct net_device *dev)
773{ 778{
774 struct tulip_private *tp = netdev_priv(dev); 779 struct tulip_private *tp = netdev_priv(dev);
775 void __iomem *ioaddr = tp->base_addr;
776 int i; 780 int i;
777 781
778 netif_stop_queue (dev);
779
780 tulip_down (dev);
781
782 if (tulip_debug > 1)
783 printk (KERN_DEBUG "%s: Shutting down ethercard, status was %2.2x.\n",
784 dev->name, ioread32 (ioaddr + CSR5));
785
786 free_irq (dev->irq, dev);
787
788 /* Free all the skbuffs in the Rx queue. */ 782 /* Free all the skbuffs in the Rx queue. */
789 for (i = 0; i < RX_RING_SIZE; i++) { 783 for (i = 0; i < RX_RING_SIZE; i++) {
790 struct sk_buff *skb = tp->rx_buffers[i].skb; 784 struct sk_buff *skb = tp->rx_buffers[i].skb;
@@ -803,6 +797,7 @@ static int tulip_close (struct net_device *dev)
803 dev_kfree_skb (skb); 797 dev_kfree_skb (skb);
804 } 798 }
805 } 799 }
800
806 for (i = 0; i < TX_RING_SIZE; i++) { 801 for (i = 0; i < TX_RING_SIZE; i++) {
807 struct sk_buff *skb = tp->tx_buffers[i].skb; 802 struct sk_buff *skb = tp->tx_buffers[i].skb;
808 803
@@ -814,6 +809,24 @@ static int tulip_close (struct net_device *dev)
814 tp->tx_buffers[i].skb = NULL; 809 tp->tx_buffers[i].skb = NULL;
815 tp->tx_buffers[i].mapping = 0; 810 tp->tx_buffers[i].mapping = 0;
816 } 811 }
812}
813
814static int tulip_close (struct net_device *dev)
815{
816 struct tulip_private *tp = netdev_priv(dev);
817 void __iomem *ioaddr = tp->base_addr;
818
819 netif_stop_queue (dev);
820
821 tulip_down (dev);
822
823 if (tulip_debug > 1)
824 printk (KERN_DEBUG "%s: Shutting down ethercard, status was %2.2x.\n",
825 dev->name, ioread32 (ioaddr + CSR5));
826
827 free_irq (dev->irq, dev);
828
829 tulip_free_ring (dev);
817 830
818 return 0; 831 return 0;
819} 832}