<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/net, branch v2.6.25.10</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>TTY: fix for tty operations bugs</title>
<updated>2008-07-03T03:46:14+00:00</updated>
<author>
<name>Alan Cox</name>
<email>alan@lxorguk.ukuu.org.uk</email>
</author>
<published>2008-06-27T14:21:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2a739dd53ad7ee010ae6e155438507f329dce788'/>
<id>2a739dd53ad7ee010ae6e155438507f329dce788</id>
<content type='text'>
This is fixed with the recent tty operations rewrite in mainline in a
different way, this is a selective backport of the relevant portions to
the -stable tree.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This is fixed with the recent tty operations rewrite in mainline in a
different way, this is a selective backport of the relevant portions to
the -stable tree.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>atl1: relax eeprom mac address error check</title>
<updated>2008-06-24T21:08:28+00:00</updated>
<author>
<name>Radu Cristescu</name>
<email>advantis@gmx.net</email>
</author>
<published>2008-06-20T01:27:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2e77edd8f4b9ab4ef6ee4ba3fdc6cf50a972cce1'/>
<id>2e77edd8f4b9ab4ef6ee4ba3fdc6cf50a972cce1</id>
<content type='text'>
upstream commit: 58c7821c4264a7ddd6f0c31c5caaf393b3897f10

The atl1 driver tries to determine the MAC address thusly:

	- If an EEPROM exists, read the MAC address from EEPROM and
	  validate it.
	- If an EEPROM doesn't exist, try to read a MAC address from
	  SPI flash.
	- If that fails, try to read a MAC address directly from the
	  MAC Station Address register.
	- If that fails, assign a random MAC address provided by the
	  kernel.

We now have a report of a system fitted with an EEPROM containing all
zeros where we expect the MAC address to be, and we currently handle
this as an error condition.  Turns out, on this system the BIOS writes
a valid MAC address to the NIC's MAC Station Address register, but we
never try to read it because we return an error when we find the all-
zeros address in EEPROM.

This patch relaxes the error check and continues looking for a MAC
address even if it finds an illegal one in EEPROM.

http://ubuntuforums.org/showthread.php?t=562617

[jacliburn@bellsouth.net: backport to 2.6.25.7]

Signed-off-by: Radu Cristescu &lt;advantis@gmx.net&gt;
Signed-off-by: Jay Cliburn &lt;jacliburn@bellsouth.net&gt;
Signed-off-by: Jeff Garzik &lt;jgarzik@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
upstream commit: 58c7821c4264a7ddd6f0c31c5caaf393b3897f10

The atl1 driver tries to determine the MAC address thusly:

	- If an EEPROM exists, read the MAC address from EEPROM and
	  validate it.
	- If an EEPROM doesn't exist, try to read a MAC address from
	  SPI flash.
	- If that fails, try to read a MAC address directly from the
	  MAC Station Address register.
	- If that fails, assign a random MAC address provided by the
	  kernel.

We now have a report of a system fitted with an EEPROM containing all
zeros where we expect the MAC address to be, and we currently handle
this as an error condition.  Turns out, on this system the BIOS writes
a valid MAC address to the NIC's MAC Station Address register, but we
never try to read it because we return an error when we find the all-
zeros address in EEPROM.

This patch relaxes the error check and continues looking for a MAC
address even if it finds an illegal one in EEPROM.

http://ubuntuforums.org/showthread.php?t=562617

[jacliburn@bellsouth.net: backport to 2.6.25.7]

Signed-off-by: Radu Cristescu &lt;advantis@gmx.net&gt;
Signed-off-by: Jay Cliburn &lt;jacliburn@bellsouth.net&gt;
Signed-off-by: Jeff Garzik &lt;jgarzik@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>b43: Fix possible NULL pointer dereference in DMA code</title>
<updated>2008-06-22T05:24:55+00:00</updated>
<author>
<name>Michael Buesch</name>
<email>mb@bu3sch.de</email>
</author>
<published>2008-06-14T20:57:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=38d10b5fd8eb81e10b9572359c90e627432217d1'/>
<id>38d10b5fd8eb81e10b9572359c90e627432217d1</id>
<content type='text'>
a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream

This fixes a possible NULL pointer dereference in an error path of the
DMA allocation error checking code. In case the DMA allocation address is invalid,
the dev pointer is dereferenced for unmapping of the buffer.

Reported-by: Miles Lane &lt;miles.lane@gmail.com&gt;
Signed-off-by: Michael Buesch &lt;mb@bu3sch.de&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream

This fixes a possible NULL pointer dereference in an error path of the
DMA allocation error checking code. In case the DMA allocation address is invalid,
the dev pointer is dereferenced for unmapping of the buffer.

Reported-by: Miles Lane &lt;miles.lane@gmail.com&gt;
Signed-off-by: Michael Buesch &lt;mb@bu3sch.de&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>b43: Fix noise calculation WARN_ON</title>
<updated>2008-06-22T05:24:55+00:00</updated>
<author>
<name>Michael Buesch</name>
<email>mb@bu3sch.de</email>
</author>
<published>2008-06-14T21:00:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f9cb92ec51b8700247c3aa560b31ba9885a33e73'/>
<id>f9cb92ec51b8700247c3aa560b31ba9885a33e73</id>
<content type='text'>
commit 98a3b2fe435ae76170936c14f5c9e6a87548e3ef upstream.

This removes a WARN_ON that is responsible for the following koops:
http://www.kerneloops.org/searchweek.php?search=b43_generate_noise_sample

The comment in the patch describes why it's safe to simply remove
the check.

Signed-off-by: Michael Buesch &lt;mb@bu3sch.de&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;


</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 98a3b2fe435ae76170936c14f5c9e6a87548e3ef upstream.

This removes a WARN_ON that is responsible for the following koops:
http://www.kerneloops.org/searchweek.php?search=b43_generate_noise_sample

The comment in the patch describes why it's safe to simply remove
the check.

Signed-off-by: Michael Buesch &lt;mb@bu3sch.de&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;


</pre>
</div>
</content>
</entry>
<entry>
<title>virtio_net: Fix skb-&gt;csum_start computation</title>
<updated>2008-06-22T05:24:54+00:00</updated>
<author>
<name>Mark McLoughlin</name>
<email>markmc@redhat.com</email>
</author>
<published>2008-06-16T04:41:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=226028e4f78348aa948b1422bda1ede029228d2e'/>
<id>226028e4f78348aa948b1422bda1ede029228d2e</id>
<content type='text'>
commit 23cde76d801246a702e7a84c3fe3d655b35c89a1 upstream.

hdr-&gt;csum_start is the offset from the start of the ethernet
header to the transport layer checksum field. skb-&gt;csum_start
is the offset from skb-&gt;head.

skb_partial_csum_set() assumes that skb-&gt;data points to the
ethernet header - i.e. it computes skb-&gt;csum_start by adding
the headroom to hdr-&gt;csum_start.

Since eth_type_trans() skb_pull()s the ethernet header,
skb_partial_csum_set() should be called before
eth_type_trans().

(Without this patch, GSO packets from a guest to the world outside the
host are corrupted).

Signed-off-by: Mark McLoughlin &lt;markmc@redhat.com&gt;
Acked-by: Herbert Xu &lt;herbert@gondor.apana.org.au&gt;
Signed-off-by: Rusty Russell &lt;rusty@rustcorp.com.au&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 23cde76d801246a702e7a84c3fe3d655b35c89a1 upstream.

hdr-&gt;csum_start is the offset from the start of the ethernet
header to the transport layer checksum field. skb-&gt;csum_start
is the offset from skb-&gt;head.

skb_partial_csum_set() assumes that skb-&gt;data points to the
ethernet header - i.e. it computes skb-&gt;csum_start by adding
the headroom to hdr-&gt;csum_start.

Since eth_type_trans() skb_pull()s the ethernet header,
skb_partial_csum_set() should be called before
eth_type_trans().

(Without this patch, GSO packets from a guest to the world outside the
host are corrupted).

Signed-off-by: Mark McLoughlin &lt;markmc@redhat.com&gt;
Acked-by: Herbert Xu &lt;herbert@gondor.apana.org.au&gt;
Signed-off-by: Rusty Russell &lt;rusty@rustcorp.com.au&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>forcedeth: msi interrupts</title>
<updated>2008-06-16T20:20:02+00:00</updated>
<author>
<name>Ayaz Abdulla</name>
<email>aabdulla@nvidia.com</email>
</author>
<published>2008-06-12T00:20:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8af4f53dd282f803621c9c5d928e17eed65e0d76'/>
<id>8af4f53dd282f803621c9c5d928e17eed65e0d76</id>
<content type='text'>
commit 4db0ee176e256444695ee2d7b004552e82fec987 upstream

Add a workaround for lost MSI interrupts.  There is a race condition in
the HW in which future interrupts could be missed.  The workaround is to
toggle the MSI irq mask.

Added cleanup based on comments from Andrew Morton.

Signed-off-by: Ayaz Abdulla &lt;aabdulla@nvidia.com&gt;
Cc: Manfred Spraul &lt;manfred@colorfullife.com&gt;
Cc: Jeff Garzik &lt;jeff@garzik.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Jeff Garzik &lt;jgarzik@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4db0ee176e256444695ee2d7b004552e82fec987 upstream

Add a workaround for lost MSI interrupts.  There is a race condition in
the HW in which future interrupts could be missed.  The workaround is to
toggle the MSI irq mask.

Added cleanup based on comments from Andrew Morton.

Signed-off-by: Ayaz Abdulla &lt;aabdulla@nvidia.com&gt;
Cc: Manfred Spraul &lt;manfred@colorfullife.com&gt;
Cc: Jeff Garzik &lt;jeff@garzik.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Jeff Garzik &lt;jgarzik@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>l2tp: Fix possible oops if transmitting or receiving when tunnel goes down</title>
<updated>2008-06-16T20:19:58+00:00</updated>
<author>
<name>James Chapman</name>
<email>jchapman@katalix.com</email>
</author>
<published>2008-06-09T20:35:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=11f814feeb526e7be8253452382ce299634540c3'/>
<id>11f814feeb526e7be8253452382ce299634540c3</id>
<content type='text'>
[ upstream commit: 24b95685ffcdb3dc28f64b9e8af6ea3e8360fbc5 ]

Some problems have been experienced in the field which cause an oops
in the pppol2tp driver if L2TP tunnels fail while passing data.

The pppol2tp driver uses private data that is referenced via the
sk-&gt;sk_user_data of its UDP and PPPoL2TP sockets. This patch makes
sure that the driver uses sock_hold() when it holds a reference to the
sk pointer. This affects its sendmsg(), recvmsg(), getname(),
[gs]etsockopt() and ioctl() handlers.

Tested by ISP where problem was seen. System has been up 10 days with
no oops since running this patch. Without the patch, an oops would
occur every 1-2 days.

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ upstream commit: 24b95685ffcdb3dc28f64b9e8af6ea3e8360fbc5 ]

Some problems have been experienced in the field which cause an oops
in the pppol2tp driver if L2TP tunnels fail while passing data.

The pppol2tp driver uses private data that is referenced via the
sk-&gt;sk_user_data of its UDP and PPPoL2TP sockets. This patch makes
sure that the driver uses sock_hold() when it holds a reference to the
sk pointer. This affects its sendmsg(), recvmsg(), getname(),
[gs]etsockopt() and ioctl() handlers.

Tested by ISP where problem was seen. System has been up 10 days with
no oops since running this patch. Without the patch, an oops would
occur every 1-2 days.

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>l2tp: Fix possible WARN_ON from socket code when UDP socket is closed</title>
<updated>2008-06-16T20:19:58+00:00</updated>
<author>
<name>James Chapman</name>
<email>jchapman@katalix.com</email>
</author>
<published>2008-06-09T20:34:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=42cd7667f27ebcf7c9aa3f814d8f0dd1aa1b39c1'/>
<id>42cd7667f27ebcf7c9aa3f814d8f0dd1aa1b39c1</id>
<content type='text'>
[ upstream commit: 199f7d24ae59894243687a234a909f44a8724506 ]

If an L2TP daemon closes a tunnel socket while packets are queued in
the tunnel's reorder queue, a kernel warning is logged because the
socket is closed while skbs are still referencing it. The fix is to
purge the queue in the socket's release handler.

WARNING: at include/net/sock.h:351 udp_lib_unhash+0x41/0x68()
Pid: 12998, comm: openl2tpd Not tainted 2.6.25 #8
 [&lt;c0423c58&gt;] warn_on_slowpath+0x41/0x51
 [&lt;c05d33a7&gt;] udp_lib_unhash+0x41/0x68
 [&lt;c059424d&gt;] sk_common_release+0x23/0x90
 [&lt;c05d16be&gt;] udp_lib_close+0x8/0xa
 [&lt;c05d8684&gt;] inet_release+0x42/0x48
 [&lt;c0592599&gt;] sock_release+0x14/0x60
 [&lt;c059299f&gt;] sock_close+0x29/0x30
 [&lt;c046ef52&gt;] __fput+0xad/0x15b
 [&lt;c046f1d9&gt;] fput+0x17/0x19
 [&lt;c046c8c4&gt;] filp_close+0x50/0x5a
 [&lt;c046da06&gt;] sys_close+0x69/0x9f
 [&lt;c04048ce&gt;] syscall_call+0x7/0xb

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ upstream commit: 199f7d24ae59894243687a234a909f44a8724506 ]

If an L2TP daemon closes a tunnel socket while packets are queued in
the tunnel's reorder queue, a kernel warning is logged because the
socket is closed while skbs are still referencing it. The fix is to
purge the queue in the socket's release handler.

WARNING: at include/net/sock.h:351 udp_lib_unhash+0x41/0x68()
Pid: 12998, comm: openl2tpd Not tainted 2.6.25 #8
 [&lt;c0423c58&gt;] warn_on_slowpath+0x41/0x51
 [&lt;c05d33a7&gt;] udp_lib_unhash+0x41/0x68
 [&lt;c059424d&gt;] sk_common_release+0x23/0x90
 [&lt;c05d16be&gt;] udp_lib_close+0x8/0xa
 [&lt;c05d8684&gt;] inet_release+0x42/0x48
 [&lt;c0592599&gt;] sock_release+0x14/0x60
 [&lt;c059299f&gt;] sock_close+0x29/0x30
 [&lt;c046ef52&gt;] __fput+0xad/0x15b
 [&lt;c046f1d9&gt;] fput+0x17/0x19
 [&lt;c046c8c4&gt;] filp_close+0x50/0x5a
 [&lt;c046da06&gt;] sys_close+0x69/0x9f
 [&lt;c04048ce&gt;] syscall_call+0x7/0xb

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>l2tp: avoid skb truesize bug if headroom is increased</title>
<updated>2008-06-16T20:19:56+00:00</updated>
<author>
<name>James Chapman</name>
<email>jchapman@katalix.com</email>
</author>
<published>2008-05-19T21:10:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=85339198d7abe9edf5204381e0d756c773a739e8'/>
<id>85339198d7abe9edf5204381e0d756c773a739e8</id>
<content type='text'>
[ upstream commit: 090c48d3dd5ea90b37350334aaed9a93b0c1e0a1 ]

A user reported seeing occasional bugs such as the following when
using the L2TP driver.

  SKB BUG: Invalid truesize (272) len=72, sizeof(sk_buff)=208

When L2TP adds its header in the transmit path, it might need to
increase the headroom of the skb. In some cases, the increased
headroom trips a kernel bug when the skb is freed because the skb has
grown beyond its truesize value. The fix is to increase the truesize
by the amount of headroom added, after orphaning the skb.

While here, fix a misleading comment.

Thanks to Iouri Kharon &lt;bc-info@styx.cabel.net&gt; for the initial
report and testing the fix.

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ upstream commit: 090c48d3dd5ea90b37350334aaed9a93b0c1e0a1 ]

A user reported seeing occasional bugs such as the following when
using the L2TP driver.

  SKB BUG: Invalid truesize (272) len=72, sizeof(sk_buff)=208

When L2TP adds its header in the transmit path, it might need to
increase the headroom of the skb. In some cases, the increased
headroom trips a kernel bug when the skb is freed because the skb has
grown beyond its truesize value. The fix is to increase the truesize
by the amount of headroom added, after orphaning the skb.

While here, fix a misleading comment.

Thanks to Iouri Kharon &lt;bc-info@styx.cabel.net&gt; for the initial
report and testing the fix.

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cassini: Only use chip checksum for ipv4 packets.</title>
<updated>2008-06-16T20:19:55+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2008-05-22T00:05:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5c1c9ddc6d50656beef56b03cf87510f1a01e5ef'/>
<id>5c1c9ddc6d50656beef56b03cf87510f1a01e5ef</id>
<content type='text'>
[ upstream commit: b1443e2f6501f06930a162ff1ff08382a98bf23e ]

According to David Monro, at least with Natsemi Saturn chips the
cassini driver has some trouble with ipv6 checksums.

Until we have more information about what's going on here, only
use the chip checksums for ipv4.

This workaround was suggested and tested by David.

Update version and release date.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ upstream commit: b1443e2f6501f06930a162ff1ff08382a98bf23e ]

According to David Monro, at least with Natsemi Saturn chips the
cassini driver has some trouble with ipv6 checksums.

Until we have more information about what's going on here, only
use the chip checksums for ipv4.

This workaround was suggested and tested by David.

Update version and release date.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Chris Wright &lt;chrisw@sous-sol.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
