aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-02-23net: amend the fix for SO_BSDCOMPAT gsopt infoleakEugene Teo
The fix for CVE-2009-0676 (upstream commit df0bca04) is incomplete. Note that the same problem of leaking kernel memory will reappear if someone on some architecture uses struct timeval with some internal padding (for example tv_sec 64-bit and tv_usec 32-bit) --- then, you are going to leak the padded bytes to userspace. Signed-off-by: Eugene Teo <eugeneteo@kernel.sg> Reported-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-23netns: build fix for net_alloc_genericClemens Noss
net_alloc_generic was defined in #ifdef CONFIG_NET_NS, but used unconditionally. Move net_alloc_generic out of #ifdef. Signed-off-by: Clemens Noss <cnoss@gmx.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-22netns: fix double free at netns creationDaniel Lezcano
This patch fix a double free when a network namespace fails. The previous code does a kfree of the net_generic structure when one of the init subsystem initialization fails. The 'setup_net' function does kfree(ng) and returns an error. The caller, 'copy_net_ns', call net_free on error, and this one calls kfree(net->gen), making this pointer freed twice. This patch make the code symetric, the net_alloc does the net_generic allocation and the net_free frees the net_generic. Signed-off-by: Daniel Lezcano <daniel.lezcano@free.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-22veth : add the set_mac_address capabilityDaniel Lezcano
Fix lost set_mac_address capability. Signed-off-by: Daniel Lezcano <daniel.lezcano@free.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-21sunlance: Beyond ARRAY_SIZE of ib->btx_ringRoel Kluin
Do not go beyond ARRAY_SIZE of ib->btx_ring Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20sungem: another error printed one too earlyroel kluin
Another error was printed one too early. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20ISDN: fix sc/shmem printk format warningRandy Dunlap
Fix isdn/sc/shmem.c printk format warning: drivers/isdn/sc/shmem.c:57: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20SMSC: timeout reaches -1Roel Kluin
With a postfix decrement timeouts will reach -1 rather than 0, so the error path does not appear. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20smsc9420: handle magic field of ethtool_eepromSteve Glendinning
ethtool.h says the driver should set the magic field in get_eeprom and verify it in set_eeprom. This patch adds this functionality using an arbitary driver-specific magic value constant (0x9420). Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20sundance: missing parentheses?Roel Kluin
Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20smsc9420: fix another postfixed timeoutSteve Glendinning
Roel Kluin recently fixed several instances where variables reach -1, but 0 is tested afterwards. This patch fixes another, so the timeout will be correctly detected and a warning printed. Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-20wimax/i2400m: driver loads firmware v1.4 instead of v1.3Inaky Perez-Gonzalez
This is a one liner change to have the driver use by default the v1.4 of the i2400m firmware instead of v1.3. The v1.4 version of the firmware has been submitted to David Woodhouse for inclusion in the linux-firmware tree and it is already available at http://linuxwimax.org/Download. The reason for this change is that the 1.3 release of the user space software and firmware has a few issues that will make it difficult to use with currently deployed commercial networks such as Xohm and Clearwire. As well, the new 1.4 release of the user space software (which matches the 1.4 firmware) has intermitent issues with the 1.3 firmware. The 1.4 release in http://linuxwimax.org/Download has been widely deployed and tested with the codebase in 2.6.29-rc, the 1.4 firmware and the 1.4 user space components. We understand it is quite late in the rc process for such a change, but would like to ask for the change to be taken into consideration. Alternatively, a user could always force feed a 1.4 firmware into a driver that doesn't have this modification by: $ cd /lib/firmware $ mv i2400m-fw-usb-1.3.sbcf i2400m-fw-usb-1.3.real.sbcf $ ln -sf i2400m-fw-usb-1.4.sbc i2400m-fw-usb-1.3.sbcf Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18vlan: Update skb->mac_header in __vlan_put_tag().Jarek Poplawski
After moving mac addresses in __vlan_put_tag() skb->mac_header needs to be updated. Reported-by: Karl Hiramoto <karl@hiramoto.org> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18cxgb3: Add support for PCI ID 0x35.Divy Le Ray
Add support for adapters with a PCI id equal to 0x35. Signed-off-by: Divy Le Ray <divy@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18tcp: remove obsoleted comment about different passesIlpo Järvinen
This is obsolete since the passes got combined. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18TG3: &&/|| confusionRoel Kluin
phyid Can't be both TG3_PHY_OUI_1 and TG3_PHY_OUI_2 and TG3_PHY_OUI_3. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18ATM: misplaced parentheses?Roel Kluin
Add missing parentheses Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18net/mv643xx: don't disable the mib timer too early and lock properlySebastian Siewior
mib_counters_update() also restarts the timer. So the timer is dequeued, the stats are read and then the timer is enqueued again. This is "okay" unless someone unloads the module. The locking here is also broken: mib_counters_update() grabs just a simple spinlock. The only thing the lock is good for is to protect the timer func against other callers namely mv643xx_eth_stop() && mv643xx_eth_get_ethtool_stats(). That means if the spinlock is taken via the ethtool path and than the timer kicks in then the box will lock up. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Acked-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18net/mv643xx: use GFP_ATOMIC while atomicSebastian Siewior
dev_set_rx_mode() grabs netif_addr_lock_bh(): |BUG: sleeping function called from invalid context at /home/bigeasy/git/cryptodev-2.6/mm/slub.c:1599 |in_atomic(): 1, irqs_disabled(): 0, pid: 859, name: ifconfig |2 locks held by ifconfig/859: | #0: (rtnl_mutex){--..}, at: [<c0239ccc>] rtnl_lock+0x18/0x20 | #1: (_xmit_ETHER){-...}, at: [<c022d094>] dev_set_rx_mode+0x1c/0x30 |[<c029f118>] (dump_stack+0x0/0x14) from [<c003df28>] (__might_sleep+0x11c/0x13c) |[<c003de0c>] (__might_sleep+0x0/0x13c) from [<c00a8854>] (kmem_cache_alloc+0x30/0xd4) | r5:c78093a0 r4:c034a47c |[<c00a8824>] (kmem_cache_alloc+0x0/0xd4) from [<c01a5fd0>] (mv643xx_eth_set_rx_mode+0x70/0x188) |[<c01a5f60>] (mv643xx_eth_set_rx_mode+0x0/0x188) from [<c022ced0>] (__dev_set_rx_mode+0x40/0xac) |[<c022ce90>] (__dev_set_rx_mode+0x0/0xac) from [<c022d09c>] (dev_set_rx_mode+0x24/0x30) | r6:00001043 r5:c78090f8 r4:c7809000 |[<c022d078>] (dev_set_rx_mode+0x0/0x30) from [<c02304c4>] (dev_open+0xe4/0x114) | r5:c7809350 r4:c7809000 |[<c02303e0>] (dev_open+0x0/0x114) from [<c022fd18>] (dev_change_flags+0xb0/0x190) | r5:00000041 r4:c7809000 |[<c022fc68>] (dev_change_flags+0x0/0x190) from [<c0270250>] (devinet_ioctl+0x2f0/0x710) | r7:c7221e70 r6:c7aadb00 r5:00000000 r4:00000001 |[<c026ff60>] (devinet_ioctl+0x0/0x710) from [<c02717c8>] (inet_ioctl+0xd4/0x110) |[<c02716f4>] (inet_ioctl+0x0/0x110) from [<c021fb74>] (sock_ioctl+0x1f4/0x254) | r4:c7242b40 |[<c021f980>] (sock_ioctl+0x0/0x254) from [<c00b8160>] (vfs_ioctl+0x38/0x98) | r6:beec9bb8 r5:00008914 r4:c7242b40 |[<c00b8128>] (vfs_ioctl+0x0/0x98) from [<c00b873c>] (do_vfs_ioctl+0x484/0x4d4) | r6:00008914 r5:c7242b40 r4:c74db1c0 |[<c00b82b8>] (do_vfs_ioctl+0x0/0x4d4) from [<c00b87cc>] (sys_ioctl+0x40/0x64) |[<c00b878c>] (sys_ioctl+0x0/0x64) from [<c00269a0>] (ret_fast_syscall+0x0/0x2c) |[42949399.520000] r7:00000036 r6:beec9c80 r5:00000041 r4:beec9bb8 Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Acked-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-18atl1c: Atheros L1C Gigabit Ethernet driverJie Yang
Supporting AR8131, and AR8132. Signed-off-by: Jie Yang <jie.yang@atheros.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-17net: Kill skb_truesize_check(), it only catches false-positives.David S. Miller
A long time ago we had bugs, primarily in TCP, where we would modify skb->truesize (for TSO queue collapsing) in ways which would corrupt the socket memory accounting. skb_truesize_check() was added in order to try and catch this error more systematically. However this debugging check has morphed into a Frankenstein of sorts and these days it does nothing other than catch false-positives. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-16net: forcedeth: Fix wake-on-lan regressionTobias Diedrich
Commit f55c21fd9a92a444e55ad1ca4e4732d56661bf2e ("forcedeth: call restore mac addr in nv_shutdown path"), which was introduced to fix the regression tracked at http://bugzilla.kernel.org/show_bug.cgi?id=11358 causes the wake-on-lan mac to be reversed in the shutdown path. Apparently the forcedeth situation is rather messy in that the mac we need to writeback for a subsequent modprobe to work is exactly the reverse of what is needed for proper wake-on-lan. The following patch explains the situation in the comments and makes the call to nv_restore_mac_addr() conditional (only called if we are not really going for poweroff). Tobias Diedrich wrote: > Hmm, I had not tried WOL for some time. > With 2.6.29-rc3 is see the following behaviour: > > State WOL Behaviour > ------------------------------ > shutdown reversed MAC > disk/shutdown reversed MAC > disk/platform OK > > Apparently nv_restore_mac_addr() restores the MAC in the wrong order > for WOL (at least for my PCI_DEVICE_ID_NVIDIA_NVENET_15). platform > works, because the MAC is not touched in the nv_suspend() path. > > A possible fix might be to only call nv_restore_mac_addr() if > system_state != SYSTEM_POWER_OFF. With the following patch: shutdown OK disk/shutdown OK disk/platform OK kexec OK Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de> Tested-by: Philipp Matthias Hahn <pmhahn@titan.lahn.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12wimax: fix oops in wimax_dev_get_by_genl_info() when looking up non-wimax ifaceInaky Perez-Gonzalez
When a non-wimax interface is looked up by the stack, a bad pointer is returned when the looked-up interface is not found in the list (of registered WiMAX interfaces). This causes an oops in the caller when trying to use the pointer. Fix by properly setting the pointer to NULL if we don't exit from the list_for_each() with a found entry. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2Clément Lecigne
In function sock_getsockopt() located in net/core/sock.c, optval v.val is not correctly initialized and directly returned in userland in case we have SO_BSDCOMPAT option set. This dummy code should trigger the bug: int main(void) { unsigned char buf[4] = { 0, 0, 0, 0 }; int len; int sock; sock = socket(33, 2, 2); getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len); printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]); close(sock); } Here is a patch that fix this bug by initalizing v.val just after its declaration. Signed-off-by: Clément Lecigne <clement.lecigne@netasq.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12netxen: fix compile waring "label ‘set_32_bit_mask’ defined but not ↵Yang Hongyang
used" on IA64 platform When compile the latest kernel on IA64 platform,I got a warning: drivers/net/netxen/netxen_nic_main.c:203: warning: label ‘set_32_bit_mask’ defined but not used We do not need label ‘set_32_bit_mask’ on IA64 platform,So move it to #else. Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12bnx2: Update version to 1.9.2 and copyright.Michael Chan
Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12bnx2: Fix jumbo frames error handling.Michael Chan
If errors are reported on a frame descriptor, we need to account for the buffer pages that may have been used for this error packet and recycle them. Otherwise, we may get the wrong pages for the next packet. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Benjamin Li <benli@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12bnx2: Update 5709 firmware.Michael Chan
New firmware fixes a data corruption issue when receiving and placing jumbo frames into host buffers. In some cases, the buffer descriptor is not updated correctly and this will lead to the driver linking the wrong number of pages into the SKB. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12bnx2: Update 5706/5708 firmware.Michael Chan
New firmware fixes a data corruption issue when receiving and placing jumbo frames into host buffers. In some cases, the buffer descriptor is not updated correctly and this will lead to the driver linking the wrong number of pages into the SKB. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-123c505: do not set pcb->data.raw beyond its sizeRoel Kluin
Ensure that we do not set pcb->data.raw beyond its size, print an error message and return false if we attempt to. A timout message was printed one too early. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12Documentation/connector/cn_test.c: don't use gfp_any()Andrew Morton
cn_test_timer_func() is a timer handler and can never use GFP_KERNEL - there's no point in using gfp_any() here. Also, use setup_timer(). Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12net: don't use in_atomic() in gfp_any()Andrew Morton
The problem is that in_atomic() will return false inside spinlocks if CONFIG_PREEMPT=n. This will lead to deadlockable GFP_KERNEL allocations from spinlocked regions. Secondly, if CONFIG_PREEMPT=y, this bug solves itself because networking will instead use GFP_ATOMIC from this callsite. Hence we won't get the might_sleep() debugging warnings which would have informed us of the buggy callsites. Solve both these problems by switching to in_interrupt(). Now, if someone runs a gfp_any() allocation from inside spinlock we will get the warning if CONFIG_PREEMPT=y. I reviewed all callsites and most of them were too complex for my little brain and none of them documented their interface requirements. I have no idea what this patch will do. Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12IRDA: cnt is off by 1Roel Kluin
If no prior break occurs, cnt reaches 101 after the loop, so we are still able to change speed when cnt has become 100. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12netxen: remove pcie workaroundDhananjay Phadke
Remove workaround for pcie bug in early revisions of NX3031 (rev 41 or earlier). This is taken care of during firmware init. The workaround required writing pcie config reg of every pcie function on a card, not all of which are enabled. Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12sun3: print when lance_open() failsRoel Kluin
With while (--i > 0) { ... } i reaches 0; print when lance_open() fails Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Add missing rx buf clean index on early exit.Ron Mercer
The large receive buffer queue is not properly tracking the current index in the case where an early exit occurs. This can happen when a page alloc or dma mapping fails. If this occurs the queue will get out of sync and invalid indexes can be written to the hardware. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Fix RX scaling values.Ron Mercer
Receive packets were only scaling across 2 of the receive queues. The value was hardcoded to 2 instead of being based on how many rx queues were running. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Fix TSO breakage.Ron Mercer
Moved the buffer mapping to a point after TSO logic has modified the iph->check field. We were seeing stale data on the PCIe bus. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Add missing dev_kfree_skb_any() call.Ron Mercer
We put the skb back if we can't get mapping for it. We don't want unmapped buffers on our receive buffer queue. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Add missing put_page() call.Ron Mercer
We put the page back if we can't get mapping for it. We don't want unmapped buffers on our receive buffer queue. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Fix fatal error recovery hang.Ron Mercer
Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12qlge: bugfix: Use netif_receive_skb() and vlan_hwaccel_receive_skb().Ron Mercer
Replace calls to vlan_hwaccel_rx() and netif_rx(). Thanks to Dave Miller for pointing out the the driver was making the wrong upcall for passing packets into the stack. Signed-off-by: Ron Mercer <ron.mercer@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-12TG3: limit reaches -1Roel Kluin
With while (limit--) { ... } limit reaches -1, so 0 means success. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-11iwlwifi: fix suspend/resume and its usage of pci saved stateReinette Chatre
Here we do two things: First, revert "iwlwifi: save PCI state before suspend, restore after resume". That misguided patch led to being unable to use iwlwifi devices after resume. Next, indicate to PCI driver that the saved PCI state is valid during suspend. We restore PCI state and enable the device when network interface is created, similarly PCI state is saved and the device is disabled when network interface is removed. Thus, when .suspend is called the PCI state is saved and device is disabled. This is the case even if an interface is never created as PCI state is saved and device disabled during .probe. PCI driver assumes PCI state is saved in .suspend. Saving the state at this time will save state of disabled device and thus cause problems during resume (resuming a disabled device). We thus indicate directly to PCI driver that current PCI saved state is valid. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Tested-by: Alex Riesen <fork0@users.sf.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-02-11zd1211rw: treat MAXIM_NEW_RF(0x08) as UW2453_RF(0x09) for TP-Link WN322/422GHin-Tak Leung
Three people (Petr Mensik <pihhan@cipis.net> ["si" should be U+0161 U+00ED], Stephen Ho <stephenhoinhk@gmail.com> on zd1211-devs and Ismael Ojeda Perez <iojedaperez@gmail.com> on linux-wireless) reported success in getting TP-Link WN322G/WN422G working by treating MAXIM_NEW_RF(0x08) as UW2453_RF(0x09) for rf chip hardware initialization. Signed-off-by: Hin-Tak Leung <htl10@users.sourceforge.net> Tested-by: Petr Mensik <pihhan@cipis.net> Tested-by: Stephen Ho <stephenhoinhk@gmail.com> Tested-by: Ismael Ojeda Perez <iojedaperez@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-02-11zd1211rw: adding 0ace:0xa211 as a ZD1211 deviceHin-Tak Leung
Christoph Biedl <sourceforge.bnwi@manchmal.in-ulm.de> reported success in the sourceforge zd1211 mailing list on this addition. This product ID was supported by the vendor driver ZD1211LnxDrv 2.22.0.0 (and possibly earlier) and it probably should have been added earlier. Signed-off-by: Hin-Tak Leung <htl10@users.sourceforge.net> Tested-by: Christoph Biedl <sourceforge.bnwi@manchmal.in-ulm.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-02-11mac80211: restrict to AP in outgoing interface heuristicJohannes Berg
We try to find the correct outgoing interface for injected frames based on the TA, but since this is a hack for hostapd 11w, restrict the heuristic to AP mode interfaces. At some point we'll add the ability to give an interface index in radiotap or so and just remove this heuristic again. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Cc: stable@kernel.org [2.6.28.x] Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-02-11ath5k: fix bf->skb==NULL panic in ath5k_tasklet_rxBob Copeland
Under memory pressure, we may not be able to allocate a new skb for new packets. If the allocation fails, ath5k_tasklet_rx will exit but will leave a buffer in the list with a NULL skb, eventually triggering a BUG_ON. Extract the skb allocation from ath5k_rxbuf_setup() and change the tasklet to allocate the next skb before accepting a packet. Changes-licensed-under: 3-Clause-BSD Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-02-10sunhme: Fix Quattro HME irq registration on proble failuresMeelis Roos
Currently, the sunhme driver installs SBus Quattro interrupt handler when at least one HME card was initialized correctly and at least one Quattro card is present. This breaks when a Quattro card fails initialization for whatever reason - IRQ is registered and OOPS happens when it fires. The solution, as suggested by David Miller, was to keep track which cards of the Quattro bundles have been initialized, and request/free the Quattro IRQ only when all four devices have been successfully initialized. The patch only touches SBus initialization - PCI init already resets the card pointer to NULL on init failure. The patch has been tested on Sun E3500 with SBus and PCI single HME cards and one PCI Quattro HME card in a situation where any PCI card failed init when the SBus routines tried to init them by mistake. Additionally it replaces Quattro request_irq panic with error return - if this card fails to work, at least let the others work. Tested on E450 with PCI HME and PCI Quad HME. [ Minor coding style fixups -DaveM ] Signed-off-by: Meelis Roos <mroos@linux.ee> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-10fore200: fix oops on failed firmware loadMeelis Roos
Fore 200 ATM driver fails to handle request_firmware failures and oopses when no firmware file was found. Fix it by checking for the right return values and propaganting the return value up. Signed-off-by: Meelis Roos <mroos@linux.ee> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 16:16:02 +0000