linux-stable.git/drivers/net/ethernet, branch v3.3.4

ksz884x: don't copy too much in netdev_set_mac_address()

2012-04-27T17:17:05+00:00

[ Upstream commit 716af4abd6e6370226f567af50bfaca274515980 ]

MAX_ADDR_LEN is 32.  ETH_ALEN is 6.  mac->sa_data is a 14 byte array, so
the memcpy() is doing a read past the end of the array.  I asked about
this on netdev and Ben Hutchings told me it's supposed to be copying
ETH_ALEN bytes (thanks Ben).

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net/ethernet: ks8851_mll fix rx frame buffer overflow

2012-04-27T17:17:04+00:00

[ Upstream commit 8a9a0ea6032186e3030419262678d652b88bf6a8 ]

At the beginning of ks_rcv(), a for loop retrieves the
header information relevant to all the frames stored
in the mac's internal buffers. The number of pending
frames is stored as an 8 bits field in KS_RXFCTR.
If interrupts are disabled long enough to allow for more than
32 frames to accumulate in the MAC's internal buffers, a buffer
overflow occurs.
This patch fixes the problem by making the
driver's frame_head_info buffer big enough.
Well actually, since the chip appears to have 12K of
internal rx buffers and the shortest ethernet frame should
be 64 bytes long, maybe the limit could be set to
12*1024/64 = 192 frames, but 255 should be safer.

Signed-off-by: Davide Ciminaghi 
Signed-off-by: Raffaele Recalcati 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: smsc911x: fix skb handling in receive path

2012-04-27T17:17:04+00:00

[ Upstream commit 3c5e979bd037888dd7d722da22da4b43659af485 ]

The SMSC911x driver resets the ->head, ->data and ->tail pointers in the
skb on the reset path in order to avoid buffer overflow due to packet
padding performed by the hardware.

This patch fixes the receive path so that the skb pointers are fixed up
after the data has been read from the device, The error path is also
fixed to use number of words consistently and prevent erroneous FIFO
fastforwarding when skipping over bad data.

Signed-off-by: Will Deacon 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

8139cp: set intr mask after its handler is registered

2012-04-27T17:17:04+00:00

[ Upstream commit a8c9cb106fe79c28d6b7f1397652cadd228715ff ]

We set intr mask before its handler is registered, this does not work well when
8139cp is sharing irq line with other devices. As the irq could be enabled by
the device before 8139cp's hander is registered which may lead unhandled
irq. Fix this by introducing an helper cp_irq_enable() and call it after
request_irq().

Signed-off-by: Jason Wang 
Reviewed-by: Flavio Leitner 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

atl1: fix kernel panic in case of DMA errors

2012-04-27T17:17:04+00:00

[ Upstream commit 03662e41c7cff64a776bfb1b3816de4be43de881 ]

Problem:
There was two separate work_struct structures which share one
handler. Unfortunately getting atl1_adapter structure from
work_struct in case of DMA error was done from incorrect
offset which cause kernel panics.

Solution:
The useless work_struct for DMA error removed and
handler name changed to more generic one.

Signed-off-by: Tony Zelenoff 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

davinci_mdio: Fix MDIO timeout check

2012-04-27T17:16:36+00:00

commit 5b76d0600b2b08eef77f8e9226938b7b6bde3099 upstream.

Under heavy load (flood ping) it is possible for the MDIO timeout to
expire before the loop checks the GO bit again. This patch adds an
additional check whether the operation was done before actually
returning -ETIMEDOUT.

To reproduce this bug, flood ping the device, e.g., ping -f -l 1000
After some time, a "timed out waiting for user access" warning
may appear. And even worse, link may go down since the PHY reported a
timeout.

Signed-off-by: Christian Riesch 
Cc: Cyril Chemparathy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Fix non TBI PHY access; a bad merge undid bug fix in a previous commit.

2012-04-13T16:13:50+00:00

[ Upstream commit 464b57da56910c8737ede75ad820b9a7afc46b3e ]

The merge done in commit b26e478f undid bug fix in commit c3e072f8
("net: fsl_pq_mdio: fix non tbi phy access"), with the result that non
TBI (e.g. MDIO) PHYs cannot be accessed.

Signed-off-by: Kenth Eriksson 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sky2: dont overwrite settings for PHY Quick link

2012-04-13T16:13:50+00:00

[ Upstream commit 2240eb4ae3dc4acff20d1a8947c441c451513e37 ]

This patch corrects a bug in function sky2_open() of the Marvell Yukon 2 driver
in which the settings for PHY quick link are overwritten.

Signed-off-by: Lino Sanfilippo 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tg3: Fix 5717 serdes powerdown problem

2012-04-13T16:13:50+00:00

[ Upstream commit 085f1afc56619bda424941412fdeaff1e32c21dc ]

If port 0 of a 5717 serdes device powers down, it hides the phy from
port 1.  This patch works around the problem by keeping port 0's phy
powered up.

Signed-off-by: Matt Carlson 
Signed-off-by: Michael Chan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

via-rhine: fix wait-bit inversion.

2012-04-13T16:13:50+00:00

[ Upstream commit 3f8c91a7398b9266fbe7abcbe4bd5dffef907643 ]

Bug appeared in a384a33bb1c9ec2d99db2046b41f57023fa7d77b
("via-rhine: RHINE_WAIT_FOR macro removal). It can be noticed
during suspend/resume.

Signed-off-by: Andreas Mohr 
Acked-by: Francois Romieu 
Cc: David Lv 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman