linux-toradex.git/drivers/net, branch v2.6.16.61

[CASSINI]: Set skb->truesize properly on receive packets.

2008-01-20T20:02:20+00:00

[ Upstream commit: d011a231675b240157a3c335dd53e9b849d7d30d ]

skb->truesize was not being incremented at all to
reflect the page based data added to RX SKBs.

Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[CASSINI]: Fix endianness bug.

2008-01-20T20:00:26+00:00

[ Upstream commit: e5e025401f6e926c1d9dc3f3f2813cf98a2d8708 ]

Here's proposed fix for RX checksum handling in cassini; it affects
little-endian working with half-duplex gigabit, but obviously needs
testing on big-endian too.

The problem is, we need to convert checksum to fixed-endian *before*
correcting for (unstripped) FCS.  On big-endian it won't matter
(conversion is no-op), on little-endian it will, but only if FCS is
not stripped by hardware; i.e. in half-duplex gigabit mode when
->crc_size is set.

cassini.c part is that fix, cassini.h one consists of trivial
endianness annotations.  With that applied the sucker is endian-clean,
according to sparse.

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

PPPOE: fix memory leak (local DoS) (CVE-2007-2525)

2007-11-13T10:12:46+00:00

This patch fixes a memory leak when a PPPoE socket is release()d after
it has been connect()ed, but before the PPPIOCGCHAN ioctl ever has been
called on it.

This is somewhat of a security problem, too, since PPPoE sockets can be
created by any user, so any user can easily allocate all the machine's
RAM to non-swappable address space and thus DoS the system.

Is there any specific reason for PPPoE sockets being available to any
unprivileged process, BTW? After all, you need a packet socket for the
discovery stage anyway, so it's unlikely that any unprivileged process
will ever need to create a PPPoE socket, no? Allocating all session IDs
for a known AC is a kind of DoS, too, after all - with Juniper ERXes,
this is really easy, actually, since they don't ever assign session ids
above 8000 ...

Signed-off-by: Florian Zumbiehl 
Signed-off-by: Adrian Bunk

[PPP_MPPE]: Don't put InterimKey on the stack

2007-11-13T06:48:46+00:00

ppp_mppe puts a crypto key on the kernel stack, then passes the
address of that into the crypto layer.  That doesn't work because the
crypto layer needs to be able to do virt_to_*() on the address which
does not universally work for the kernel stack on all platforms.

Adrian Bunk:
Backported to 2.6.16.

Signed-off-by: Michal Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[PPP]: Fix output buffer size in ppp_decompress_frame().

2007-09-24T21:02:46+00:00

This patch addresses the issue with "osize too small" errors in mppe
encryption.  The patch fixes the issue with wrong output buffer size
being passed to ppp decompression routine.

--------------------
As pointed out by Suresh Mahalingam, the issue addressed by
ppp-fix-osize-too-small-errors-when-decoding patch is not fully resolved yet.
The size of allocated output buffer is correct, however it size passed to
ppp->rcomp->decompress in ppp_generic.c if wrong. The patch fixes that.
--------------------

Signed-off-by: Konstantin Sharlaimov 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[PPP]: Fix osize too small errors when decoding mppe.

2007-09-24T21:01:54+00:00

The mppe_decompress() function required a buffer that is 1 byte too
small when receiving a message of mru size. This fixes buffer
allocation to prevent this from occurring.

Signed-off-by: Konstantin Sharlaimov 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

8139too.c: fix netpoll deadlock

2007-07-22T16:03:53+00:00

fix deadlock in the 8139too driver: poll handlers should never forcibly
enable local interrupts, because they might be used by netpoll/printk
from IRQ context.

  =================================
  [ INFO: inconsistent lock state ]
  2.6.19 #11
  ---------------------------------
  inconsistent {softirq-on-W} -> {in-softirq-W} usage.
  swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes:
   (&npinfo->poll_lock){-+..}, at: [] net_rx_action+0x64/0x1de
  {softirq-on-W} state was registered at:
    [] mark_lock+0x5b/0x39c
    [] mark_held_locks+0x4b/0x68
    [] trace_hardirqs_on+0x115/0x139
    [] rtl8139_poll+0x3d7/0x3f4
    [] netpoll_poll+0x82/0x32f
    [] netpoll_send_skb+0xc9/0x12f
    [] netpoll_send_udp+0x253/0x25b
    [] write_msg+0x40/0x65
    [] __call_console_drivers+0x45/0x51
    [] _call_console_drivers+0x5d/0x61
    [] release_console_sem+0x11f/0x1d8
    [] register_console+0x1ac/0x1b3
    [] init_netconsole+0x55/0x67
    [] init+0x9a/0x24e
    [] kernel_thread_helper+0x7/0x10
    [] 0xffffffff
  irq event stamp: 819992
  hardirqs last  enabled at (819992): [] net_rx_action+0x39/0x1de
  hardirqs last disabled at (819991): [] net_rx_action+0x141/0x1de
  softirqs last  enabled at (817552): [] __do_softirq+0xa3/0xa8
  softirqs last disabled at (819987): [] do_softirq+0x5b/0xc9

  other info that might help us debug this:
  no locks held by swapper/1.

  stack backtrace:
   [] dump_trace+0x63/0x1e8
   [] show_trace_log_lvl+0x19/0x2e
   [] show_trace+0x12/0x14
   [] dump_stack+0x14/0x16
   [] print_usage_bug+0x23c/0x246
   [] mark_lock+0x108/0x39c
   [] __lock_acquire+0x361/0x9ed
   [] lock_acquire+0x56/0x72
   [] _spin_lock+0x35/0x42
   [] net_rx_action+0x64/0x1de
   [] __do_softirq+0x52/0xa8
   [] do_softirq+0x5b/0xc9
   [] irq_exit+0x3c/0x48
   [] do_IRQ+0xa4/0xbd
   [] common_interrupt+0x2e/0x34
   [] vprintk+0x2c0/0x309
   [] printk+0x1b/0x1d
   [] init+0x80/0x24e
   [] kernel_thread_helper+0x7/0x10
   =======================

Signed-off-by: Ingo Molnar 
Signed-off-by: Adrian Bunk

[NETPOLL]: Remove CONFIG_NETPOLL_RX

2007-05-22T22:43:37+00:00

Get rid of the CONFIG_NETPOLL_RX option completely since all the
dependencies have been removed long ago...

Signed-off-by: Sergei Shtylyov 
Acked-by: Jeff Garzik 
Acked-by: Matt Mackall 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

sky2: turn on clocks when doing resume

2007-04-13T20:58:24+00:00

Some of these chips are disabled until clock is enabled.
This fixes:
     http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404107

Signed-off-by: Stephen Hemminger 
Signed-off-by: Adrian Bunk

sky2: turn carrier off when down

2007-04-13T20:58:23+00:00

Driver needs to turn off carrier when down.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Adrian Bunk