Commit f7a8db89 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  tproxy: fixe a possible read from an invalid location in the socket match
  zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr()
  mac80211: use unaligned safe memcmp() in-place of compare_ether_addr()
  ipw2200: fix netif_*_queue() removal regression
  iwlwifi: clean key table in iwl_clear_stations_table function
  tcp: tcp_vegas ssthresh bug fix
  can: omit received RTR frames for single ID filter lists
  ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table
  netx-eth: initialize per device spinlock
  tcp: make urg+gso work for real this time
  enc28j60: Fix sporadic packet loss (corrected again)
  hysdn: fix writing outside the field on 64 bits
  b1isa: fix b1isa_exit() to really remove registered capi controllers
  can: Fix CAN_(EFF|RTR)_FLAG handling in can_filter
  Phonet: do not dump addresses from other namespaces
  netlabel: Fix a potential NULL pointer dereference
  bnx2: Add workaround to handle missed MSI.
  xfrm: Fix kernel panic when flush and dump SPD entries
parents 6f84b4db c49b9f29

drivers/isdn/hardware/avm/b1isa.c

+2 −4
Original line number Diff line number Diff line
@@ -233,9 +233,7 @@ static void __exit b1isa_exit(void) 
	int i;



	for (i = 0; i < MAX_CARDS; i++) {

		if (!io[i])

			break;



		if (isa_dev[i].resource[0].start)

			b1isa_remove(&isa_dev[i]);

	}

	unregister_capi_driver(&capi_driver_b1isa);

drivers/isdn/hysdn/hysdn_net.c

+2 −2
Original line number Diff line number Diff line
@@ -83,12 +83,12 @@ net_open(struct net_device *dev) 


	/* Fill in the MAC-level header (if not already set) */

	if (!card->mac_addr[0]) {

		for (i = 0; i < ETH_ALEN - sizeof(unsigned long); i++)

		for (i = 0; i < ETH_ALEN; i++)

			dev->dev_addr[i] = 0xfc;

		if ((in_dev = dev->ip_ptr) != NULL) {

			struct in_ifaddr *ifa = in_dev->ifa_list;

			if (ifa != NULL)

				memcpy(dev->dev_addr + (ETH_ALEN - sizeof(unsigned long)), &ifa->ifa_local, sizeof(unsigned long));

				memcpy(dev->dev_addr + (ETH_ALEN - sizeof(ifa->ifa_local)), &ifa->ifa_local, sizeof(ifa->ifa_local));

		}

	} else

		memcpy(dev->dev_addr, card->mac_addr, ETH_ALEN);

drivers/net/bnx2.c

+32 −3
Original line number Diff line number Diff line
@@ -3144,6 +3144,28 @@ bnx2_has_work(struct bnx2_napi *bnapi) 
	return 0;

}



static void

bnx2_chk_missed_msi(struct bnx2 *bp)

{

	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];

	u32 msi_ctrl;



	if (bnx2_has_work(bnapi)) {

		msi_ctrl = REG_RD(bp, BNX2_PCICFG_MSI_CONTROL);

		if (!(msi_ctrl & BNX2_PCICFG_MSI_CONTROL_ENABLE))

			return;



		if (bnapi->last_status_idx == bp->idle_chk_status_idx) {

			REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl &

			       ~BNX2_PCICFG_MSI_CONTROL_ENABLE);

			REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl);

			bnx2_msi(bp->irq_tbl[0].vector, bnapi);

		}

	}



	bp->idle_chk_status_idx = bnapi->last_status_idx;

}



static void bnx2_poll_link(struct bnx2 *bp, struct bnx2_napi *bnapi)

{

	struct status_block *sblk = bnapi->status_blk.msi;
@@ -3218,14 +3240,15 @@ static int bnx2_poll(struct napi_struct *napi, int budget) 


		work_done = bnx2_poll_work(bp, bnapi, work_done, budget);



		if (unlikely(work_done >= budget))

			break;



		/* bnapi->last_status_idx is used below to tell the hw how

		 * much work has been processed, so we must read it before

		 * checking for more work.

		 */

		bnapi->last_status_idx = sblk->status_idx;



		if (unlikely(work_done >= budget))

			break;



		rmb();

		if (likely(!bnx2_has_work(bnapi))) {

			netif_rx_complete(bp->dev, napi);
@@ -4570,6 +4593,8 @@ bnx2_init_chip(struct bnx2 *bp) 
	for (i = 0; i < BNX2_MAX_MSIX_VEC; i++)

		bp->bnx2_napi[i].last_status_idx = 0;



	bp->idle_chk_status_idx = 0xffff;



	bp->rx_mode = BNX2_EMAC_RX_MODE_SORT_MODE;



	/* Set up how to generate a link change interrupt. */
@@ -5718,6 +5743,10 @@ bnx2_timer(unsigned long data) 
	if (atomic_read(&bp->intr_sem) != 0)

		goto bnx2_restart_timer;



	if ((bp->flags & (BNX2_FLAG_USING_MSI | BNX2_FLAG_ONE_SHOT_MSI)) ==

	     BNX2_FLAG_USING_MSI)

		bnx2_chk_missed_msi(bp);



	bnx2_send_heart_beat(bp);



	bp->stats_blk->stat_FwRxDrop =

drivers/net/bnx2.h

+6 −0
Original line number Diff line number Diff line
@@ -378,6 +378,9 @@ struct l2_fhdr { 
 *  pci_config_l definition

 *  offset: 0000

 */

#define BNX2_PCICFG_MSI_CONTROL				0x00000058

#define BNX2_PCICFG_MSI_CONTROL_ENABLE			 (1L<<16)



#define BNX2_PCICFG_MISC_CONFIG				0x00000068

#define BNX2_PCICFG_MISC_CONFIG_TARGET_BYTE_SWAP	 (1L<<2)

#define BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP	 (1L<<3)
@@ -6863,6 +6866,9 @@ struct bnx2 { 


	u8			num_tx_rings;

	u8			num_rx_rings;



	u32			idle_chk_status_idx;



};



#define REG_RD(bp, offset)					\

drivers/net/enc28j60.c

+14 −2
Original line number Diff line number Diff line
@@ -568,6 +568,17 @@ static u16 erxrdpt_workaround(u16 next_packet_ptr, u16 start, u16 end) 
	return erxrdpt;

}



/*

 * Calculate wrap around when reading beyond the end of the RX buffer

 */

static u16 rx_packet_start(u16 ptr)

{

	if (ptr + RSV_SIZE > RXEND_INIT)

		return (ptr + RSV_SIZE) - (RXEND_INIT - RXSTART_INIT + 1);

	else

		return ptr + RSV_SIZE;

}



static void nolock_rxfifo_init(struct enc28j60_net *priv, u16 start, u16 end)

{

	u16 erxrdpt;
@@ -938,7 +949,8 @@ static void enc28j60_hw_rx(struct net_device *ndev) 
			skb->dev = ndev;

			skb_reserve(skb, NET_IP_ALIGN);

			/* copy the packet from the receive buffer */

			enc28j60_mem_read(priv, priv->next_pk_ptr + sizeof(rsv),

			enc28j60_mem_read(priv,

				rx_packet_start(priv->next_pk_ptr),

				len, skb_put(skb, len));

			if (netif_msg_pktdata(priv))

				dump_packet(__func__, skb->len, skb->data);

CRA Git | Maintained and supported by SUSTech CRA and CCSE