Andrew Dyer wrote:
I noticed the au1xxx ethernet driver has a malloc where the return value isn't checked. I did some more looking while waiting for a slow flash programmer and at least these files seem to do the same thing:
./cpu/ppc4xx/440gx_enet.c
Here's a patch to fix 440gx_enet.c
CHANGELOG Patch by Travis B. Sawyer, 18 July 2005 Check return value of malloc in 440gx_enet.c
Best regards,
Travis
--- u-boot_patched/cpu/ppc4xx/440gx_enet.c 2005-07-13 11:30:40.000000000 -0400 +++ u-boot/cpu/ppc4xx/440gx_enet.c 2005-07-18 22:13:03.000000000 -0400 @@ -267,7 +267,7 @@ int ppc_440x_eth_setup_bridge(int devnum
static int ppc_440x_eth_init (struct eth_device *dev, bd_t * bis) { - int i; + int i, j; unsigned long reg; unsigned long msr; unsigned long speed; @@ -566,6 +566,8 @@ static int ppc_440x_eth_init (struct eth hw_p->alloc_tx_buf = (mal_desc_t *) malloc ((sizeof (mal_desc_t) * NUM_TX_BUFF) + ((2 * CFG_CACHELINE_SIZE) - 2)); + if (NULL == hw_p->alloc_tx_buf) + return -1; if (((int) hw_p->alloc_tx_buf & CACHELINE_MASK) != 0) { hw_p->tx = (mal_desc_t *) ((int) hw_p->alloc_tx_buf + @@ -579,6 +581,12 @@ static int ppc_440x_eth_init (struct eth hw_p->alloc_rx_buf = (mal_desc_t *) malloc ((sizeof (mal_desc_t) * NUM_RX_BUFF) + ((2 * CFG_CACHELINE_SIZE) - 2)); + if (NULL == hw_p->alloc_rx_buf) { + free(hw_p->alloc_tx_buf); + hw_p->alloc_tx_buf = NULL; + return -1; + } + if (((int) hw_p->alloc_rx_buf & CACHELINE_MASK) != 0) { hw_p->rx = (mal_desc_t *) ((int) hw_p->alloc_rx_buf + @@ -592,9 +600,20 @@ static int ppc_440x_eth_init (struct eth for (i = 0; i < NUM_TX_BUFF; i++) { hw_p->tx[i].ctrl = 0; hw_p->tx[i].data_len = 0; - if (hw_p->first_init == 0) + if (hw_p->first_init == 0) { hw_p->txbuf_ptr = (char *) malloc (ENET_MAX_MTU_ALIGNED); + if (NULL == hw_p->txbuf_ptr) { + free(hw_p->alloc_rx_buf); + free(hw_p->alloc_tx_buf); + hw_p->alloc_rx_buf = NULL; + hw_p->alloc_tx_buf = NULL; + for(j = 0; j < i; j++) { + free(hw_p->tx[i].data_ptr); + hw_p->tx[i].data_ptr = NULL; + } + } + } hw_p->tx[i].data_ptr = hw_p->txbuf_ptr; if ((NUM_TX_BUFF - 1) == i) hw_p->tx[i].ctrl |= MAL_TX_CTRL_WRAP;