diff options
author | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2008-03-04 20:20:58 -0800 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2008-03-04 20:20:58 -0800 |
commit | 27d0483aa1ef66a8877d71b63bb97f46ab0246b2 (patch) | |
tree | ca84a9db8c79b789d40d2d9ae30d0349fd3562fc /drivers/net | |
parent | 665c1ef8369138dad7773da6407fe77ccff87deb (diff) | |
parent | dea75bdfa57f75a7a7ec2961ec28db506c18e5db (diff) | |
download | op-kernel-dev-27d0483aa1ef66a8877d71b63bb97f46ab0246b2.zip op-kernel-dev-27d0483aa1ef66a8877d71b63bb97f46ab0246b2.tar.gz |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (22 commits)
[IPCONFIG]: The kernel gets no IP from some DHCP servers
b43legacy: Fix module init message
rndis_wlan: fix broken data copy
libertas: compare the current command with response
libertas: fix sanity check on sequence number in command response
p54: fix eeprom parser length sanity checks
p54: fix EEPROM structure endianness
ssb: Add pcibios_enable_device() return value check
rc80211-pid: fix rate adjustment
[ESP]: Add select on AUTHENC
[TCP]: Improve ipv4 established hash function.
[NETPOLL]: Revert two bogus cleanups that broke netconsole.
[PPPOL2TP]: Add missing sock_put() in pppol2tp_tunnel_closeall()
Subject: [PPPOL2TP] add missing sock_put() in pppol2tp_recv_dequeue()
[BLUETOOTH]: l2cap info_timer delete fix in hci_conn_del
[NET]: Fix race in generic address resolution.
iucv: fix build error on !SMP
[TCP]: Must count fack_count also when skipping
[TUN]: Fix RTNL-locking in tun/tap driver
[SCTP]: Use proc_create to setup de->proc_fops.
...
Diffstat (limited to 'drivers/net')
-rw-r--r-- | drivers/net/pppol2tp.c | 8 | ||||
-rw-r--r-- | drivers/net/tun.c | 6 | ||||
-rw-r--r-- | drivers/net/wireless/b43legacy/main.c | 2 | ||||
-rw-r--r-- | drivers/net/wireless/libertas/cmdresp.c | 8 | ||||
-rw-r--r-- | drivers/net/wireless/p54common.c | 20 | ||||
-rw-r--r-- | drivers/net/wireless/p54common.h | 8 | ||||
-rw-r--r-- | drivers/net/wireless/rndis_wlan.c | 8 |
7 files changed, 35 insertions, 25 deletions
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c index e0b072d..86e5dba 100644 --- a/drivers/net/pppol2tp.c +++ b/drivers/net/pppol2tp.c @@ -455,6 +455,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session) skb_queue_len(&session->reorder_q)); __skb_unlink(skb, &session->reorder_q); kfree_skb(skb); + sock_put(session->sock); continue; } @@ -1110,6 +1111,8 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel) for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) { again: hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) { + struct sk_buff *skb; + session = hlist_entry(walk, struct pppol2tp_session, hlist); sk = session->sock; @@ -1138,7 +1141,10 @@ again: /* Purge any queued data */ skb_queue_purge(&sk->sk_receive_queue); skb_queue_purge(&sk->sk_write_queue); - skb_queue_purge(&session->reorder_q); + while ((skb = skb_dequeue(&session->reorder_q))) { + kfree_skb(skb); + sock_put(sk); + } release_sock(sk); sock_put(sk); diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 038c1ef..7b816a0 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -663,7 +663,11 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file, case SIOCSIFHWADDR: { /* try to set the actual net device's hw address */ - int ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr); + int ret; + + rtnl_lock(); + ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr); + rtnl_unlock(); if (ret == 0) { /** Set the character device's hardware address. This is used when diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c index c39de42..5f3f34e 100644 --- a/drivers/net/wireless/b43legacy/main.c +++ b/drivers/net/wireless/b43legacy/main.c @@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(void) #ifdef CONFIG_B43LEGACY_DMA feat_dma = "D"; #endif - printk(KERN_INFO "Broadcom 43xx driver loaded " + printk(KERN_INFO "Broadcom 43xx-legacy driver loaded " "[ Features: %s%s%s%s%s, Firmware-ID: " B43legacy_SUPPORTED_FIRMWARE_ID " ]\n", feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma); diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c index 159216a..bdc6a1c 100644 --- a/drivers/net/wireless/libertas/cmdresp.c +++ b/drivers/net/wireless/libertas/cmdresp.c @@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_private *priv) } resp = (void *)priv->upld_buf; - - curcmd = le16_to_cpu(resp->command); - + curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command); respcmd = le16_to_cpu(resp->command); result = le16_to_cpu(resp->result); @@ -572,9 +570,9 @@ int lbs_process_rx_command(struct lbs_private *priv) respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies); lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len); - if (resp->seqnum != resp->seqnum) { + if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) { lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n", - le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum)); + le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum)); spin_unlock_irqrestore(&priv->driver_lock, flags); ret = -1; goto done; diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c index 5cda49a..d191e05 100644 --- a/drivers/net/wireless/p54common.c +++ b/drivers/net/wireless/p54common.c @@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len) struct p54_common *priv = dev->priv; struct eeprom_pda_wrap *wrap = NULL; struct pda_entry *entry; - int i = 0; unsigned int data_len, entry_len; void *tmp; int err; + u8 *end = (u8 *)eeprom + len; wrap = (struct eeprom_pda_wrap *) eeprom; - entry = (void *)wrap->data + wrap->len; - i += 2; - i += le16_to_cpu(entry->len)*2; - while (i < len) { + entry = (void *)wrap->data + le16_to_cpu(wrap->len); + + /* verify that at least the entry length/code fits */ + while ((u8 *)entry <= end - sizeof(*entry)) { entry_len = le16_to_cpu(entry->len); data_len = ((entry_len - 1) << 1); + + /* abort if entry exceeds whole structure */ + if ((u8 *)entry + sizeof(*entry) + data_len > end) + break; + switch (le16_to_cpu(entry->code)) { case PDR_MAC_ADDRESS: SET_IEEE80211_PERM_ADDR(dev, entry->data); @@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len) priv->version = *(u8 *)(entry->data + 1); break; case PDR_END: - i = len; + /* make it overrun */ + entry_len = len; break; } entry = (void *)entry + (entry_len + 1)*2; - i += 2; - i += entry_len*2; } if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) { diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h index a721334..b67ff34 100644 --- a/drivers/net/wireless/p54common.h +++ b/drivers/net/wireless/p54common.h @@ -53,10 +53,10 @@ struct pda_entry { } __attribute__ ((packed)); struct eeprom_pda_wrap { - u32 magic; - u16 pad; - u16 len; - u32 arm_opcode; + __le32 magic; + __le16 pad; + __le16 len; + __le32 arm_opcode; u8 data[0]; } __attribute__ ((packed)); diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index d9460ae..10b776c 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -260,7 +260,7 @@ struct NDIS_802_11_KEY { __le32 KeyLength; u8 Bssid[6]; u8 Padding[6]; - __le64 KeyRSC; + u8 KeyRSC[8]; u8 KeyMaterial[32]; } __attribute__((packed)); @@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev, struct usbnet *usbdev = dev->priv; struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev); struct NDIS_802_11_KEY ndis_key; - int i, keyidx, ret; + int keyidx, ret; u8 *addr; keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX; @@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev, ndis_key.KeyIndex = cpu_to_le32(keyidx); if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) { - for (i = 0; i < 6; i++) - ndis_key.KeyRSC |= - cpu_to_le64(ext->rx_seq[i] << (i * 8)); + memcpy(ndis_key.KeyRSC, ext->rx_seq, 6); ndis_key.KeyIndex |= cpu_to_le32(1 << 29); } |