summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2008-05-01tehuti: move ioctl perm check closer to function start (CVE-2008-1675)Jeff Garzik
Commit f946dffed6334f08da065a89ed65026ebf8b33b4 upstream Noticed by davem. Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-05-01tehuti: check register size (CVE-2008-1675)Francois Romieu
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-04-18macb: Call phy_disconnect on removingAtsushi Nemoto
upstream commit: 84b7901f8d5a17536ef2df7fd628ab865df8fe3a Call phy_disconnect() on remove routine. Otherwise the phy timer causes a kernel crash when unloading. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Cc: Haavard Skinnemoen <hskinnemoen@atmel.com> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-04-18plip: replace spin_lock_irq with spin_lock_irqsave in irq contextMikulas Patocka
upstream commit: cabce28ec0a0ae3d0ddfa4461f0e8be94ade9e46 Plip uses spin_lock_irq/spin_unlock_irq in its IRQ handler (called from parport IRQ handler), the latter enables interrupts without parport subsystem IRQ handler expecting it. The bug can be seen if you compile kernel with lock dependency checking and use plip --- it produces a warning. This patch changes it to spin_lock_irqsave/spin_lock_irqrestore, so that it doesn't enable interrupts when already disabled. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-04-18sis190: read the mac address from the eeprom firstFrancois Romieu
upstream commit: 563e0ae06ff18f0b280f11cf706ba0172255ce52 Reading a serie of zero from the cmos sram area do not work well with is_valid_ether_addr(). Let's read the mac address from the eeprom first as it seems more reliable. Fix for http://bugzilla.kernel.org/show_bug.cgi?id=9831 Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: Jeff Garzik <jeff@garzik.org> dsd@gentoo.org notes: This patch fixes http://bugs.gentoo.org/207706 Cc: Daniel Drake <dsd@gentoo.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-04-18PPPOL2TP: Fix SMP issues in skb reorder queue handlingJames Chapman
Upstream commit: e653181dd6b3ad38ce14904351b03a5388f4b0f7 When walking a session's packet reorder queue, use skb_queue_walk_safe() since the list could be modified inside the loop. Rearrange the unlinking skbs from the reorder queue such that it is done while the queue lock is held in pppol2tp_recv_dequeue() when walking the skb list. A version of this patch was suggested by Jarek Poplawski. Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-04-18PPPOL2TP: Make locking calls softirq-safeJames Chapman
Upstream commit: cf3752e2d203bbbfc88d29e362e6938cef4339b3 Fix locking issues in the pppol2tp driver which can cause a kernel crash on SMP boxes. There were two problems:- 1. The driver was violating read_lock() and write_lock() scheduling rules because it wasn't using softirq-safe locks in softirq contexts. So we now consistently use the _bh variants of the lock functions. 2. The driver was calling sk_dst_get() in pppol2tp_xmit() which was taking sk_dst_lock in softirq context. We now call __sk_dst_get(). Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-04-18SUNGEM: Fix NAPI assertion failure.David S. Miller
Upstream commit: da990a2402aeaee84837f29054c4628eb02f7493 As reported by Johannes Berg: I started getting this warning with recent kernels: [ 773.908927] ------------[ cut here ]------------ [ 773.908954] Badness at net/core/dev.c:2204 ... If we loop more than once in gem_poll(), we'll use more than the real budget in our gem_rx() calls, thus eventually trigger the caller's assertions in net_rx_action(). Subtract "work_done" from "budget" for the second arg to gem_rx() to fix the bug. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-03-24macb: Fix speed settingAtsushi Nemoto
commit: 179956f498bd8cc55fb803c4ee0cf18be59c8b01 Fix NCFGR.SPD setting on 10Mbps. This bug was introduced by conversion to generic PHY layer in kernel 2.6.23. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: Haavard Skinnemoen <hskinnemoen@atmel.com> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-03-24b43: Backport bcm4311 fixMichael Buesch
This is a backport of upstream commit 013978b6 ("b43: Changes to enable BCM4311 rev 02 with wireless core revision 13") and the changes include the following: (1) Add the 802.11 rev 13 device to the ssb_device_id table to load b43. (2) Add PHY revision 9 to the supported list. (3) Change the 2-bit routing code for address extensions to 0b10 rather than the 0b01 used for the 32-bit case. (4) Remove some magic numbers in the DMA setup. The DMA implementation for this chip supports full 64-bit addressing with one exception. Whenever the Descriptor Ring Buffer is in high memory, a fatal DMA error occurs. This problem was not present in 2.6.24-rc2 due to code to "Bias the placement of kernel pages at lower PFNs". When commit 44048d70 reverted that code, the DMA error appeared. As a "fix", use the GFP_DMA flag when allocating the buffer for 64-bit DMA. At present, this problem is thought to arise from a hardware error. Signed-off-by: Michael Buesch <mb@bu3sch.de> Cc: Larry Finger <Larry.Finger@lwfinger.net> Cc: John W. Linville <linville@tuxdriver.com> Cc: Alexey Zaytsev <alexey.zaytsev@gmail.com> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-03-24e1000e: Fix CRC stripping in hardware context bugAuke Kok
CRC stripping was only correctly enabled for packet split recieves which is used when receiving jumbo frames. Correctly enable SECRC also for normal buffer packet receives. Tested by Andy Gospodarek and Johan Andersson, see bugzilla #9940. Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com> Signed-off-by: Jeff Garzik <jeff@garzik.org> Cc: Mike Pagano <mike@mpagano.com> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-03-24NIU: Bump driver version and release date.David S. Miller
Upstream commit: a442585952f137bd4cdb1f2f3166e4157d383b82 Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-03-24NIU: Fix BMAC alternate MAC address indexing.Matheos Worku
Upstream commit: 3b5bcedeeb755b6e813537fcf4c32f010b490aef BMAC port alternate MAC address index needs to start at 1. Index 0 is used for the main MAC address. Signed-off-by: Matheos Worku <matheos.worku@sun.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-03-24NIU: More BMAC alt MAC address fixes.Matheos Worku
Upstream commit: fa907895b7b776208a1406efe5ba7ffe0f49f507 From: Matheos Worku <Matheos.Worku@Sun.COM> 1) niu_enable_alt_mac() needs to be adjusted so that the mask is computed properly for the BMAC case. 2) BMAC has 6 alt MAC addresses available, not 7. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2008-02-25bonding: fix NULL pointer deref in startup processingJay Vosburgh
patch 4fe4763cd8cacd81d892193efb48b99c99c15323 in mainline. Fix the "are we creating a duplicate" check to not compare the name if the name is NULL (meaning that the system should select a name). Bug reported by Benny Amorsen <benny+usenet@amorsen.dk>. Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-25PCMCIA: Fix station address detection in smcChuck Ebbert
Commit: a1a98b72dbd17e53cd92b8e78f404525ebcfd981 Fix station address detection in smc Megahertz EM1144 PCMCIA ethernet adapter needs special handling because it has two VERS_1 tuples and the station address is in the second one. Conversion to generic handling of these fields broke it. Reverting that fixes the device. https://bugzilla.redhat.com/show_bug.cgi?id=233255 Thanks go to Jon Stanley for not giving up on this one until the problem was found. Signed-off-by: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-25Fix dl2k constantsAl Viro
patch 9c52fab2f187636b39afb0dcf562872ed42ab608 in mainline. The MSSR constants didn't match the reality - bitfield declarations used to be correct (1000BT_FD - bit 11, 1000BT_HD - bit 10), but enum had them the other way round. Went unnoticed until the switch from the bitfields use to the explicit arithmetics and I hadn't caught that one when verifying correctness of change... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43: Reject new firmware earlyMichael Buesch
(not in mainline, as it is not applicable.) We must reject new incompatible firmware early to avoid running into strange transmission failures. The current development tree supports newer firmware revisions. These revisions cause strange failures on the stable 2.6.24 kernel. Add a check to avoid confusing users a lot. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43legacy: fix DMA slot resource leakageStefano Brivio
patch 8dd0100ce9511e52614ecd0a6587c13ce5769c8b in mainline. This fixes four resource leakages. In any error path we must deallocate the DMA frame slots we previously allocated by request_slot(). This is done by storing the ring pointers before doing any ring allocation and restoring the old pointers in case of an error. This patch by Michael Buesch has been ported to b43legacy. Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43legacy: drop packets we are not able to encryptStefano Brivio
patch 9eca9a8e81928685b4de00ecef83a7c13c340fc9 in mainline. We must drop any packets we are not able to encrypt. We must not send them unencrypted or with an all-zero-key (which basically is the same as unencrypted, from a security point of view). This might only trigger shortly after resume before mac80211 reassociated and reconfigured the keys. It is safe to drop these packets, as the association they belong to is not guaranteed anymore anyway. This is a security fix in the sense that it prevents information leakage. This patch by Michael Buesch has been ported to b43legacy. Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43legacy: fix suspend/resumeStefano Brivio
patch ada50731c0346bf900dc387edd3a6961297bf2d3 in mainline. This patch makes suspend/resume work with the b43legacy driver. We must not overwrite the MAC addresses in the init function, as this would also overwrite the MAC on resume. With an all-zero MAC the device firmware is not able to ACK any received packets anymore. Fix this by moving the initializion stuff that must be done on init but not on resume to the start function. Also zero out filter_flags to make sure we don't have some flags from a previous instance for a tiny timeframe until mac80211 reconfigures them. This patch by Michael Buesch has been ported to b43legacy. Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43legacy: fix PIO crashStefano Brivio
patch 0cd67d48b519c3d8d89d238fab1cf68a5289638a in mainline. Fix the crash reported below, which seems to happen on bcm4306 rev. 2 devices only while using PIO: Oops: 0000 [#1] PREEMPT Modules linked in: b43(F) rfkill(F) led_class(F) input_polldev(F) arc4 b43legacy mac80211 cfg80211 i915 drm snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device ohci1394 ieee1394 ssb pcmcia snd_intel8x0m ehci_hcd uhci_hcd evdev Pid: 0, comm: swapper Tainted: GF (2.6.24st3 #2) EIP: 0060:[<f90f667b>] EFLAGS: 00010002 CPU: 0 EIP is at b43legacy_pio_handle_txstatus+0xbb/0x210 [b43legacy] EAX: 0000049b EBX: f11f8044 ECX: 00000001 EDX: 00000000 ESI: f1ff8000 EDI: 00000000 EBP: f11f8040 ESP: c04f4ef4 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process swapper (pid: 0, ti=c04f4000 task=c0488300 task.ti=c04b8000) Stack: f90f2788 c05009f0 c0500900 000010f7 f1053823 c04f4f24 dfb8e800 00000003 f1368000 00000007 00000296 f90f1975 00001000 010c0800 01000000 00000007 f90f6391 f11f8000 00000082 c04f4f4a 00000000 00004fd0 10f70000 8c061000 Call Trace: [<f90f2788>] b43legacy_debugfs_log_txstat+0x48/0xb0 [b43legacy] [<f90f1975>] b43legacy_handle_hwtxstatus+0x75/0x80 [b43legacy] [<f90f6391>] b43legacy_pio_rx+0x201/0x280 [b43legacy] [<f90e4fa3>] b43legacy_interrupt_tasklet+0x2e3/0x870 [b43legacy] [<c0123567>] tasklet_action+0x27/0x60 [<c01237b4>] __do_softirq+0x54/0xb0 [<c010686b>] do_softirq+0x7b/0xe0 [<c01457c0>] handle_level_irq+0x0/0x110 [<c01457c0>] handle_level_irq+0x0/0x110 [<c0123758>] irq_exit+0x38/0x40 [<c0106953>] do_IRQ+0x83/0xd0 [<c011812f>] __update_rq_clock+0x4f/0x180 [<c0104b4f>] common_interrupt+0x23/0x28 [<c011007b>] wakeup_code+0x7b/0xde [<c02b1039>] acpi_processor_idle+0x24a/0x3c9 [<c01025c7>] cpu_idle+0x47/0x80 [<c04b9ad5>] start_kernel+0x205/0x290 [<c04b9360>] unknown_bootoption+0x0/0x1f0 ======================= Code: 0f 00 00 81 fb ff 00 00 00 0f 87 36 01 00 00 8d 04 db 85 ff 8d 6c c6 40 8d 5d 04 0f 85 ef 00 00 00 fe 4e 0e 0f b7 46 0c 8b 53 04 <8b> 4a 50 29 c8 83 e8 52 66 89 46 0c 8b 54 24 14 80 7a 0b 00 74 EIP: [<f90f667b>] b43legacy_pio_handle_txstatus+0xbb/0x210 [b43legacy] SS:ESP 0068:c04f4ef4 Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43: Fix dma-slot resource leakageMichael Buesch
patch 8dd0100ce9511e52614ecd0a6587c13ce5769c8b in mainline. This fixes four resource leakages. In any error path we must deallocate the DMA frame slots we previously allocated by request_slot(). This is done by storing the ring pointers before doing any ring allocation and restoring the old pointers in case of an error. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43: Drop packets we are not able to encryptMichael Buesch
patch 09552ccd8277e6382097e93a40f7311a09449367 in mainline We must drop any packets we are not able to encrypt. We must not send them unencrypted or with an all-zero-key (which basically is the same as unencrypted, from a security point of view). This might only trigger shortly after resume before mac80211 reassociated and reconfigured the keys. It is safe to drop these packets, as the association they belong to is not guaranteed anymore anyway. This is a security fix in the sense that it prevents information leakage. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08b43: Fix suspend/resumeMichael Buesch
patch 7be1bb6b798d506693d2d8668e801951996b5a4a in mainline. This patch makes suspend/resume work with the b43 driver. We must not overwrite the MAC addresses in the init function, as this would also overwrite the MAC on resume. With an all-zero MAC the device firmware is not able to ACK any received packets anymore. Fix this by moving the initializion stuff that must be done on init but not on resume to the start function. Also zero out filter_flags to make sure we don't have some flags from a previous instance for a tiny timeframe until mac80211 reconfigures them. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08sky2: fix for WOL on some devicesStephen Hemminger
patch 82637e808478087ce861129745fa60cc37e7929d in mainline This patch disables config mode access after clearing PCI settings. Without this change WOL won't work on some BIOS's Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08sky2: restore multicast addresses after recoveryStephen Hemminger
patch a7bffe722c996679b4fb2103ecaf673ec2b9b4a7 in mainline. If the sky2 deadman timer forces a recovery, the multicast hash list is lost. Move the call to sky2_set_multicast to the end of sky2_up() so all paths that bring device up will restore multicast. Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-02-08forcedeth: mac address mcp77/79Ayaz Abdulla
patch 2b91213064bd882c3adf35f028c6d12fab3269ec in mainline. This patch is a critical fix for MCP77 and MCP79 devices. The feature flags were missing the define for correct mac address (DEV_HAS_CORRECT_MACADDR). Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com> Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-01-23sis190: scheduling while atomic errorFrancois Romieu
sis190_tx_timeout -> sis190_hw_start -> sis190_soft_reset -> msleep *splat* PCI transactions are correctly flushed here. The msleep() is probably useless. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: K.M. Liu <kmliu@sis.com.tw>
2008-01-23sis190: mdio operation failure is not correctly detectedFrancois Romieu
i ranges from 0 to 100 in the 'for' loop a few lines above. Reported by davem. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: K.M. Liu <kmliu@sis.com.tw>
2008-01-23sis190: remove duplicate INIT_WORKFrancois Romieu
It is already done in sis190_init_one. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: K.M. Liu <kmliu@sis.com.tw>
2008-01-23sis190: add cmos ram access code for the SiS19x/968 chipset pairFrancois Romieu
More work is needed to handle correctly the PHY of the new devices when connected to a 10Mb link but this change already helps some users as is. Fix for: http://bugzilla.kernel.org/show_bug.cgi?id=9467 Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: K.M. Liu <kmliu@sis.com.tw> Cc: J. Gleacher <jgleacher@yahoo.com> Cc: Alexandre Penasso Teixeira <alexandre@keepsoftware.com> Cc: Arliton Rocha <arliton@gmail.com> Cc: Juan Jose Pablos <juanjo@apertus.es> Cc: Wipat Srutiprom <wipat.s@psu.ac.th>
2008-01-23iwlwifi: fix possible read attempt on ucode that is not availableReinette Chatre
This fixes a NULL pointer dereference that can occur when the ucode is not loaded at the time __iwl_up is called. The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid= Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2008-01-23[TULIP] DMFE: Fix SROM parsing regression.David S. Miller
Changeset 16b110c3fd760620b4a787db6ed512fe531ab1b5 (dmfe warning fix) bothed up the offsets read from the SROM so that it doesn't read the same datums it used to. The change made transformations like turning: "srom + 34" into "(__le32 *)srom + 34/4" which doesn't work because 4 does not divide evenly into 34 so we're using a different pointer offset than in the original code. I've changed theses cases in dmfe_parse_srom() to consistently use "(type *)(srom + offset)" preserving the offsets from the original code. Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-22Fix file references in documentation and KconfigJohann Felix Soden
Fix typo in arch/powerpc/boot/flatdevtree_env.h. There is no Documentation/networking/ixgbe.txt. README.cycladesZ is now in Documentation/. wavelan.p.h is now in drivers/net/wireless/. HFS.txt is now Documentation/filesystems/hfs.txt. OSS-files are now in sound/oss/. Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net> Acked-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-01-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: [ICMP]: ICMP_MIB_OUTMSGS increment duplicated [IPV6]: RFC 2011 compatibility broken [IPV6]: ICMP6_MIB_OUTMSGS increment duplicated [NET]: rtnl_link: fix use-after-free [AF_KEY]: Fix skb leak on pfkey_send_migrate() error [ATM] atm/suni.c: Fix section mismatch. [ATM] atm/idt77105.c: Fix section mismatch. [IrDA]: af_irda memory leak fixes [NEIGH]: Revert 'Fix race between neigh_parms_release and neightbl_fill_parms' [NETFILTER]: bridge-netfilter: fix net_device refcnt leaks [IPV6] ROUTE: Make sending algorithm more friendly with RFC 4861. [IPV4] FIB_HASH : Avoid unecessary loop in fn_hash_dump_zone() [NET]: Fix interrupt semaphore corruption in Intel drivers. [IPV4] fib_trie: fix duplicated route issue [IPV4] fib_hash: fix duplicated route issue [IPV6]: Mischecked tw match in __inet6_check_established. rfkill: call rfkill_led_trigger_unregister() on error
2008-01-22tc35815: Use irq number for tc35815-mac platform device idAtsushi Nemoto
The tc35815-mac platform device used a pci bus number and a devfn to identify its target device, but the pci bus number may vary if some bus-bridges are found. Use irq number which is be unique for embedded controllers. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2008-01-20[NET]: rtnl_link: fix use-after-freePatrick McHardy
When unregistering the rtnl_link_ops, all existing devices using the ops are destroyed. With nested devices this may lead to a use-after-free despite the use of for_each_netdev_safe() in case the upper device is next in the device list and is destroyed by the NETDEV_UNREGISTER notifier. The easy fix is to restart scanning the device list after removing a device. Alternatively we could add new devices to the front of the list to avoid having dependant devices follow the device they depend on. A third option would be to only restart scanning if dev->iflink of the next device matches dev->ifindex of the current one. For now this seems like the safest solution. With this patch, the veth rtnl_link_ops unregistration can use rtnl_link_unregister() directly since it now also handles destruction of multiple devices at once. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-20[NET]: Fix interrupt semaphore corruption in Intel drivers.David S. Miller
Several of the Intel ethernet drivers keep an atomic counter used to manage when to actually hit the hardware with a disable or an enable. The way the net_rx_work() breakout logic works during a pending napi_disable() is that it simply unschedules the poll even if it still has work. This can potentially leave interrupts disabled, but that is OK because all of the drivers are about to disable interrupts anyways in all such code paths that do a napi_disable(). Unfortunately, this trips up the semaphore used here in the Intel drivers. If you hit this case, when you try to bring the interface back up it won't enable interrupts. A reload of the driver module fixes it of course. So what we do is make sure all the sequences now go: napi_disable(); atomic_set(&adapter->irq_sem, 0); *_irq_disable(); which makes sure the counter is always in the correct state. Reported by Robert Olsson. Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-18Replace cpmac fixMatteo Croce
Please apply this patch since i reverted by mistake the commit 4e3ab47a547616e583c7a5458beced6aa34c8ef3 in 6cd043d99dcf5d252fcc682958541f449113f7b3 Signed-off-by: Matteo Croce <technoboy85@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18dl2k: the restAl Viro
remove an unused union-with-bitfield of the same sort, add missing conversions in debugging printk Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18dl2k: MSCR, MSSR, ESR, PHY_SCR fixesAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18dl2k: BMSR fixesAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18dl2k: ANAR, ANLPAR fixesAl Viro
same story, different registers... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18dl2k: BMCR_t fixesAl Viro
broken use of bitfields; FUBAR on big-endian (and not valid C, strictly speaking). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-183c574, 3c515 bitfields abuseAl Viro
wn3_config is shared by these cards; the way we deal with it is both bad C (union abuse) and broken on big-endian. For 3c515 it's less serious (ISA cards are quite rare outside of little-endian boxen), but 3c574 is a pcmcia one and that'd better be endian-independent... Fix is the same in both cases. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18sbni endian fixesAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18wan/lmc bitfields fixesAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18dscc4 endian fixesAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
2008-01-18S2io: Fixed synchronization between scheduling of napi with card reset and closeSreenivasa Honnur
- Fixed synchronization between scheduling of napi with card reset and close by moving the enabling and disabling of napi to card up and card down functions respectively instead of open and close. Signed-off-by: Surjit Reang <surjit.reang@neterion.com> Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>