From 8f22757ee84da64d4f662f1dd03dae95358a1efe Mon Sep 17 00:00:00 2001 From: Dave Jones Date: Sat, 11 Mar 2006 18:49:13 -0800 Subject: [TUN]: Fix leak in tun_get_user() We're leaking an skb in a failure path in this function. Coverity #632 Signed-off-by: Dave Jones Signed-off-by: David S. Miller --- drivers/net/tun.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 50b8c6754b1..a1ed2d98374 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -249,8 +249,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv, if (align) skb_reserve(skb, align); - if (memcpy_fromiovec(skb_put(skb, len), iv, len)) + if (memcpy_fromiovec(skb_put(skb, len), iv, len)) { + tun->stats.rx_dropped++; + kfree_skb(skb); return -EFAULT; + } skb->dev = tun->dev; switch (tun->flags & TUN_TYPE_MASK) { -- cgit v1.2.3 From 0ade309be739eceedc4812798da09d698a59867d Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Sat, 11 Mar 2006 18:49:38 -0800 Subject: [TG3] tg3_bus_string(): remove dead code The Coverity checker spotted this dead code (note that (clock_ctrl == 7) is already handled above). Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller --- drivers/net/tg3.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index 15545620ab0..b8f1524da55 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c @@ -10543,8 +10543,6 @@ static char * __devinit tg3_bus_string(struct tg3 *tp, char *str) strcat(str, "66MHz"); else if (clock_ctrl == 6) strcat(str, "100MHz"); - else if (clock_ctrl == 7) - strcat(str, "133MHz"); } else { strcpy(str, "PCI:"); if (tp->tg3_flags & TG3_FLAG_PCI_HIGH_SPEED) -- cgit v1.2.3 From aa49cdd93be6328113f0c146fc72be173d578d27 Mon Sep 17 00:00:00 2001 From: Jesse Brandeburg Date: Wed, 15 Mar 2006 10:55:24 -0800 Subject: e100: fix eeh on pseries during ethtool -t Olaf Hering reported a problem on pseries with e100 where ethtool -t would cause a bus error, and the e100 driver would stop working. Due to the new load ucode command the cb list must be allocated before calling e100_init_hw, so remove the call and just let e100_up take care of it. Signed-off-by: Jesse Brandeburg --- drivers/net/e100.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/e100.c b/drivers/net/e100.c index 24253c807e5..f57a85feda3 100644 --- a/drivers/net/e100.c +++ b/drivers/net/e100.c @@ -2154,6 +2154,9 @@ static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode) msleep(10); + pci_dma_sync_single_for_cpu(nic->pdev, nic->rx_to_clean->dma_addr, + RFD_BUF_LEN, PCI_DMA_FROMDEVICE); + if(memcmp(nic->rx_to_clean->skb->data + sizeof(struct rfd), skb->data, ETH_DATA_LEN)) err = -EAGAIN; @@ -2161,8 +2164,8 @@ static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode) err_loopback_none: mdio_write(nic->netdev, nic->mii.phy_id, MII_BMCR, 0); nic->loopback = lb_none; - e100_hw_init(nic); e100_clean_cbs(nic); + e100_hw_reset(nic); err_clean_rx: e100_rx_clean_list(nic); return err; -- cgit v1.2.3 From c3d7a3a4eb5e8f290d7b1d61430eed1ebedeb936 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Wed, 15 Mar 2006 14:26:28 -0800 Subject: [PATCH] e1000 endianness bugs return -E_NO_BIG_ENDIAN_TESTING; [E1000]: Fix 4 missed endianness conversions on RX descriptor fields. Signed-off-by: David S. Miller Signed-off-by: Jeff Garzik --- drivers/net/e1000/e1000_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c index 4c4db96d0b7..84dcca3776e 100644 --- a/drivers/net/e1000/e1000_main.c +++ b/drivers/net/e1000/e1000_main.c @@ -3710,7 +3710,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter, e1000_rx_checksum(adapter, (uint32_t)(status) | ((uint32_t)(rx_desc->errors) << 24), - rx_desc->csum, skb); + le16_to_cpu(rx_desc->csum), skb); skb->protocol = eth_type_trans(skb, netdev); #ifdef CONFIG_E1000_NAPI @@ -3854,11 +3854,11 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter, } e1000_rx_checksum(adapter, staterr, - rx_desc->wb.lower.hi_dword.csum_ip.csum, skb); + le16_to_cpu(rx_desc->wb.lower.hi_dword.csum_ip.csum), skb); skb->protocol = eth_type_trans(skb, netdev); if (likely(rx_desc->wb.upper.header_status & - E1000_RXDPS_HDRSTAT_HDRSP)) + cpu_to_le16(E1000_RXDPS_HDRSTAT_HDRSP))) adapter->rx_hdr_split++; #ifdef CONFIG_E1000_NAPI if (unlikely(adapter->vlgrp && (staterr & E1000_RXD_STAT_VP))) { @@ -3884,7 +3884,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter, #endif next_desc: - rx_desc->wb.middle.status_error &= ~0xFF; + rx_desc->wb.middle.status_error &= cpu_to_le32(~0xFF); buffer_info->skb = NULL; /* return some buffers to hardware, one at a time is too slow */ -- cgit v1.2.3 From 232a347a444e687b5f8cf0f6485704db1c6024d3 Mon Sep 17 00:00:00 2001 From: Scott Bardone Date: Thu, 16 Mar 2006 19:20:40 -0500 Subject: [netdrvr] fix array overflows in Chelsio driver Adrian Bunk wrote: > The Coverity checker spotted the following two array overflows in > drivers/net/chelsio/sge.c (in both cases, the arrays contain 3 > elements): [snip] This is a bug. The array should contain 2 elements. Here is the fix. Signed-off-by: Scott Bardone Signed-off-by: Jeff Garzik --- drivers/net/chelsio/sge.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c index 2c5b849b7ba..30ff8ea1a40 100644 --- a/drivers/net/chelsio/sge.c +++ b/drivers/net/chelsio/sge.c @@ -1021,7 +1021,7 @@ static void restart_tx_queues(struct sge *sge) if (test_and_clear_bit(nd->if_port, &sge->stopped_tx_queues) && netif_running(nd)) { - sge->stats.cmdQ_restarted[3]++; + sge->stats.cmdQ_restarted[2]++; netif_wake_queue(nd); } } @@ -1350,7 +1350,7 @@ static int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter, if (unlikely(credits < count)) { netif_stop_queue(dev); set_bit(dev->if_port, &sge->stopped_tx_queues); - sge->stats.cmdQ_full[3]++; + sge->stats.cmdQ_full[2]++; spin_unlock(&q->lock); if (!netif_queue_stopped(dev)) CH_ERR("%s: Tx ring full while queue awake!\n", @@ -1358,7 +1358,7 @@ static int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter, return NETDEV_TX_BUSY; } if (unlikely(credits - count < q->stop_thres)) { - sge->stats.cmdQ_full[3]++; + sge->stats.cmdQ_full[2]++; netif_stop_queue(dev); set_bit(dev->if_port, &sge->stopped_tx_queues); } -- cgit v1.2.3