a7y18lte-ubports/android_kernel_samsung_universal7885
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Browse Source 
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: SNMP NAT: fix memory corruption
  [IRDA]: fixup type of ->lsap_state
  [IRDA]: fix 16/32 bit confusion
  [NET]: Fix "ntohl(ntohs" bugs
  [BNX2]: Use kmalloc instead of array
  [BNX2]: Fix bug in bnx2_nvram_write()
  [TG3]: Add some missing rx error counters
This commit is contained in:
Linus Torvalds 2006-05-23 10:40:19 -07:00
commit 9cfe864842
9 changed files with 35 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/net/bnx2.c
View File

@ -55,8 +55,8 @@
#define DRV_MODULE_NAME "bnx2" #define DRV_MODULE_NAME "bnx2"
#define PFX DRV_MODULE_NAME ": " #define PFX DRV_MODULE_NAME ": "
#define DRV_MODULE_VERSION "1.4.39" #define DRV_MODULE_VERSION "1.4.40"
#define DRV_MODULE_RELDATE "March 22, 2006" #define DRV_MODULE_RELDATE "May 22, 2006"
#define RUN_AT(x) (jiffies + (x)) #define RUN_AT(x) (jiffies + (x))
@ -2945,7 +2945,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
int buf_size) int buf_size)
{ {
u32 written, offset32, len32; u32 written, offset32, len32;
u8 *buf, start[4], end[4]; u8 *buf, start[4], end[4], *flash_buffer = NULL;
int rc = 0; int rc = 0;
int align_start, align_end; int align_start, align_end;
@ -2985,12 +2985,19 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
memcpy(buf + align_start, data_buf, buf_size); memcpy(buf + align_start, data_buf, buf_size);
} }
if (bp->flash_info->buffered == 0) {
flash_buffer = kmalloc(264, GFP_KERNEL);
if (flash_buffer == NULL) {
rc = -ENOMEM;
goto nvram_write_end;
}
}
written = 0; written = 0;
while ((written < len32) && (rc == 0)) { while ((written < len32) && (rc == 0)) {
u32 page_start, page_end, data_start, data_end; u32 page_start, page_end, data_start, data_end;
u32 addr, cmd_flags; u32 addr, cmd_flags;
int i; int i;
u8 flash_buffer[264];
/* Find the page_start addr */ /* Find the page_start addr */
page_start = offset32 + written; page_start = offset32 + written;
@ -3061,7 +3068,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
} }
/* Loop to write the new data from data_start to data_end */ /* Loop to write the new data from data_start to data_end */
for (addr = data_start; addr < data_end; addr += 4, i++) { for (addr = data_start; addr < data_end; addr += 4, i += 4) {
if ((addr == page_end - 4) || if ((addr == page_end - 4) ||
((bp->flash_info->buffered) && ((bp->flash_info->buffered) &&
(addr == data_end - 4))) { (addr == data_end - 4))) {
@ -3109,6 +3116,9 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
} }
nvram_write_end: nvram_write_end:
if (bp->flash_info->buffered == 0)
kfree(flash_buffer);
if (align_start || align_end) if (align_start || align_end)
kfree(buf); kfree(buf);
return rc; return rc;

8
drivers/net/tg3.c
View File

@ -69,8 +69,8 @@
#define DRV_MODULE_NAME "tg3" #define DRV_MODULE_NAME "tg3"
#define PFX DRV_MODULE_NAME ": " #define PFX DRV_MODULE_NAME ": "
#define DRV_MODULE_VERSION "3.57" #define DRV_MODULE_VERSION "3.58"
#define DRV_MODULE_RELDATE "Apr 28, 2006" #define DRV_MODULE_RELDATE "May 22, 2006"
#define TG3_DEF_MAC_MODE 0 #define TG3_DEF_MAC_MODE 0
#define TG3_DEF_RX_MODE 0 #define TG3_DEF_RX_MODE 0
@ -6488,6 +6488,10 @@ static void tg3_periodic_fetch_stats(struct tg3 *tp)
TG3_STAT_ADD32(&sp->rx_frame_too_long_errors, MAC_RX_STATS_FRAME_TOO_LONG); TG3_STAT_ADD32(&sp->rx_frame_too_long_errors, MAC_RX_STATS_FRAME_TOO_LONG);
TG3_STAT_ADD32(&sp->rx_jabbers, MAC_RX_STATS_JABBERS); TG3_STAT_ADD32(&sp->rx_jabbers, MAC_RX_STATS_JABBERS);
TG3_STAT_ADD32(&sp->rx_undersize_packets, MAC_RX_STATS_UNDERSIZE); TG3_STAT_ADD32(&sp->rx_undersize_packets, MAC_RX_STATS_UNDERSIZE);
TG3_STAT_ADD32(&sp->rxbds_empty, RCVLPC_NO_RCV_BD_CNT);
TG3_STAT_ADD32(&sp->rx_discards, RCVLPC_IN_DISCARDS_CNT);
TG3_STAT_ADD32(&sp->rx_errors, RCVLPC_IN_ERRORS_CNT);
} }
static void tg3_timer(unsigned long __opaque) static void tg3_timer(unsigned long __opaque)

2
include/net/irda/irlmp.h
View File

@ -112,7 +112,7 @@ struct lsap_cb {
struct timer_list watchdog_timer; struct timer_list watchdog_timer;
IRLMP_STATE lsap_state; /* Connection state */ LSAP_STATE lsap_state; /* Connection state */
notify_t notify; /* Indication/Confirm entry points */ notify_t notify; /* Indication/Confirm entry points */
struct qos_info qos; /* QoS for this connection */ struct qos_info qos; /* QoS for this connection */

2
net/ipv4/ipcomp.c
View File

@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
skb->h.icmph->code != ICMP_FRAG_NEEDED) skb->h.icmph->code != ICMP_FRAG_NEEDED)
return; return;
spi = ntohl(ntohs(ipch->cpi)); spi = htonl(ntohs(ipch->cpi));
x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
spi, IPPROTO_COMP, AF_INET); spi, IPPROTO_COMP, AF_INET);
if (!x) if (!x)

11
net/ipv4/netfilter/ip_nat_snmp_basic.c
View File

@ -1003,12 +1003,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
return 1; return 1;
err_id_free:
kfree(trap->id);
err_addr_free: err_addr_free:
kfree((unsigned long *)trap->ip_address); kfree((unsigned long *)trap->ip_address);
err_id_free:
kfree(trap->id);
return 0; return 0;
} }
@ -1126,11 +1126,10 @@ static int snmp_parse_mangle(unsigned char *msg,
struct snmp_v1_trap trap; struct snmp_v1_trap trap;
unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check); unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
/* Discard trap allocations regardless */ if (ret) {
kfree(trap.id); kfree(trap.id);
kfree((unsigned long *)trap.ip_address); kfree((unsigned long *)trap.ip_address);
} else
if (!ret)
return ret; return ret;
} else { } else {

2
net/ipv4/xfrm4_policy.c
View File

@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
if (pskb_may_pull(skb, xprth + 4 - skb->data)) { if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
u16 *ipcomp_hdr = (u16 *)xprth; u16 *ipcomp_hdr = (u16 *)xprth;
fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1])); fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
} }
break; break;
default: default:

2
net/ipv6/ipcomp6.c
View File

@ -208,7 +208,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG) if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
return; return;
spi = ntohl(ntohs(ipcomph->cpi)); spi = htonl(ntohs(ipcomph->cpi));
x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6); x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
if (!x) if (!x)
return; return;

3
net/irda/iriap.c
View File

@ -544,7 +544,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self,
{ {
struct sk_buff *tx_skb; struct sk_buff *tx_skb;
int n; int n;
__u32 tmp_be32, tmp_be16; __u32 tmp_be32;
__be16 tmp_be16;
__u8 *fp; __u8 *fp;
IRDA_DEBUG(4, "%s()\n", __FUNCTION__); IRDA_DEBUG(4, "%s()\n", __FUNCTION__);

2
net/xfrm/xfrm_input.c
View File

@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
case IPPROTO_COMP: case IPPROTO_COMP:
if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr))) if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
return -EINVAL; return -EINVAL;
*spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2))); *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2)));
*seq = 0; *seq = 0;
return 0; return 0;
default: default: