@@ -1226,8 +1226,12 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
DMA_TABLE_BYTES,
DMA_BIDIRECTIONAL);
- if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma) ||
- rx_ring_dma + size > DMA_BIT_MASK(30)) {
+ if (dma_mapping_error(bp->sdev->dma_dev, rx_ring_dma))
+ goto rx_failed;
+ if (rx_ring_dma + size > DMA_BIT_MASK(30)+1) {
+ dma_unmap_single(bp->sdev->dma_dev, rx_ring_dma,
+ DMA_TABLE_BYTES, DMA_BIDIRECTIONAL);
+rx_failed:
kfree(rx_ring);
goto out_err;
}
@@ -1254,8 +1258,12 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp)
DMA_TABLE_BYTES,
DMA_TO_DEVICE);
- if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma) ||
- tx_ring_dma + size > DMA_BIT_MASK(30)) {
+ if (dma_mapping_error(bp->sdev->dma_dev, tx_ring_dma))
+ goto tx_failed;
+ if (tx_ring_dma + size > DMA_BIT_MASK(30)+1) {
+ dma_unmap_single(bp->sdev->dma_dev, tx_ring_dma,
+ DMA_TABLE_BYTES, DMA_TO_DEVICE);
+tx_failed:
kfree(tx_ring);
goto out_err;
}
It's an unlikely error path during initialization, but let's not leak DMA mappings. Also the condition for an unacceptable mapping is corrected from dma_addr + len > 0x3fffffff to dma_addr + len > 0x40000000, as in the previous patch. Signed-off-by: George Spelvin <lkml@sdf.org> --- drivers/net/ethernet/broadcom/b44.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)