linux-stable.git/drivers/net, branch linux-2.6.11.y

[PATCH] 3c59x: only put the device into D3 when we're actually using WOL

2005-05-27T04:20:01+00:00

During a warm boot the device is in D3 and has troubles coming out of it.

Signed-off-by: Daniel Ritz 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Chris Wright

[PATCH] Fix kernel panic on receive with WAN Hitachi SCA HD6457x

2005-05-12T17:00:15+00:00

Another patch for 2.6.11.x: already in main tree, fixes kernel panic on
receive with WAN cards based on Hitachi SCA/SCA-II: N2, C101, PCI200SYN.
The attached patch fixes NULL pointer dereference on RX.

Signed-off-by: Krzysztof Halasa 
Acked-by: Jeff Garzik 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Possible VIA-Rhine free irq issue

2005-05-12T17:00:14+00:00

It seems to me that in the VIA Rhine device driver the requested irq might
not be freed in case the alloc_ring() function fails. alloc_ring()
can fail with a ENOMEM return value because of possible
pci_alloc_consistent() failures.

Updated to CodingStyle.

Signed-off-by: Jeff Garzik 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix check for underflow

2005-05-12T17:00:14+00:00

http://bugme.osdl.org/show_bug.cgi?id=4279
Summary: When I try to start vpnc the net/core/skbuff.c:91 crash

This check is wrong, gcc optimizes it away:

                if ((len -= sizeof(pi)) > len)
			return -EINVAL;

This could be responsible for the BUG. If len is 2 or 3 and TUN_NO_PI
isn't set it underflows. alloc_skb() allocates len + 2, which is 0 or
1 byte. skb_reserve tries to reserve 2 bytes and things explode in
skb_put.

[TUN]: Fix check for underflow

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Possible AMD8111e free irq issue

2005-05-12T17:00:13+00:00

It seems to me that if in the amd8111e_open() fuction dev->irq isn't
zero and the irq request succeeds it might not get released anymore.

Specifically, on failure of the amd8111e_restart() call the function
returns -ENOMEM without releasing the irq. The amd8111e_restart()
function can fail because of various pci_alloc_consistent() and
dev_alloc_skb() calls in amd8111e_init_ring() which is being
called by amd8111e_restart.

1374     if(dev->irq ==0 || request_irq(dev->irq, amd8111e_interrupt, SA_SHIRQ,
1375                      dev->name, dev))
1376         return -EAGAIN;

Signed-off-by: Jeff Garzik 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] CAN-2005-0384: Remote Linux DoS on ppp servers

2005-05-12T17:00:11+00:00

Martin Schulze writes:

> Ben Martel and Stephen Blackheath have discovered a denial-of-service attack
> that a client of pppd can make that can hang the server machine.  The bug is
> in the Linux kernel 2.6 (tested on 2.6.9), but it looks like it also exists
> in the 2.4 series.

Yes, this is my bug. :(

I would just do this instead:

Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] older chips oops on shutdown

2005-05-12T17:00:10+00:00

Kernel 2.6.11, hardware is a MSI KT333-based board with an XP1800.

I'm oopsing on shutdown on a machine that has a Via Rhine adapter in it:

Unable to handle kernel paging request at virtual address e0803003
  printing eip:
c01f262c
*pde = 014dc067
*pte = 00000000
Oops: 0000 [#1]
Modules linked in: cpufreq_userspace cpufreq_powersave cpufreq_ondemand
CPU:    0
EIP:    0060:[]    Not tainted VLI
EFLAGS: 00010292   (2.6.11)
EIP is at ioread8+0x2c/0x40
eax: e0803003   ebx: e0803003   ecx: c026b430   edx: e0803003
esi: dff90260   edi: e0802f80   ebp: dd117e74   esp: dd117e74
ds: 007b   es: 007b   ss: 0068
Process reboot (pid: 5769, threadinfo=dd117000 task=dfafa080)
Stack: dd117e8c c026b490 dff90040 c151ccd4 c044a1a8 b7fdc078 dd117ea4
c0253ad9
        c151ccd4 00000042 fee1dead 00000001 dd117fbc c012461c c04d72a8 00000001
        00000000 00010800 00000000 dd117ed8 c013b40b dffe7380 00030800 00000000
Call Trace:
  [] show_stack+0x7f/0xa0
  [] show_registers+0x15a/0x1c0
  [] die+0xce/0x150
  [] do_page_fault+0x356/0x692
  [] error_code+0x2b/0x30
  [] rhine_shutdown+0x60/0x140
  [] device_shutdown+0x89/0x8b
  [] sys_reboot+0xac/0x200
  [] sysenter_past_esp+0x52/0x75
Code: 3d ff ff 03 00 89 c2 89 e5 77 20 66 31 c0 3d 00 00 01 00 75 0c
81 e2 ff ff 00 00 ec 0f b6 c0 c9 c3 0f 0b 37 00 7b 65 3b c0 eb ea <0f>
b6 00 eb ec eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 55

Seems like it is the ioread8 in:

         /* Hit power state D3 (sleep) */
         iowrite8(ioread8(ioaddr + StickyHW) | 0x03, ioaddr + StickyHW);

that fails. StickyHW is 0x83. lspci says:

0000:00:07.0 Ethernet controller: VIA Technologies, Inc. VT86C100A
[Rhine] (rev 06)
         Flags: bus master, medium devsel, latency 32, IRQ 18
         I/O ports at ec00 [size=128]
         Memory at dfffff80 (32-bit, non-prefetchable) [size=128]

In other words, it's trying to read outside of the I/O range (0x80),
which matches the fauling address.

I'm guessing my chip revision doesn't support WOL, it's a crappy noname
card.

It does seem as if rhine_power_init checks quirks for rqWOL before
touching any registers. Should rhine_shutdown do the same? Proposed
patch below, which resolves the problem on my system.

Check to make sure WOL is supported before setting it up in
rhine_shutdown.

Signed-off-by: Olof Johansson 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] sis900 kernel oops fix

2005-05-12T17:00:10+00:00

Backport of fix described below.

  From: Herbert Xu 

  Fix bug #4223.

  OK, this happened because we got preempted before sis900_mii_probe
  finished setting the sis_priv->mii.  Theoretically this can happen
  with SMP as well but I suppose the number of SMP machines with sis900
  is fairly small.

  Anyway, the fix is to make sure that sis900_mii_probe is done before
  the device can be opened.  This patch does it by moving the setup
  before register_netdevice.

  Since the netdev name is not available before register_netdev, I've
  changed the relevant printk's to use pci_name instead.  Note that
  one of those printk's may be called after register_netdev as well.

Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] r8169: receive descriptor length fix

2005-05-12T17:00:10+00:00

The status and received packets indication in the Rx descriptor ring
are not correctly reset when a descriptor is recycled.

Signed-off-by: Francois Romieu 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

2.6.11 import

2005-05-12T16:59:06+00:00