linux-stable.git/drivers/net, branch linux-2.6.24.y

tehuti: move ioctl perm check closer to function start (CVE-2008-1675)

2008-05-01T21:49:00+00:00

Commit f946dffed6334f08da065a89ed65026ebf8b33b4 upstream

Noticed by davem.

Signed-off-by: Jeff Garzik 
Signed-off-by: Greg Kroah-Hartman

tehuti: check register size (CVE-2008-1675)

2008-05-01T21:48:59+00:00

Signed-off-by: Francois Romieu 
Signed-off-by: Jeff Garzik 
Signed-off-by: Greg Kroah-Hartman

macb: Call phy_disconnect on removing

2008-04-19T01:53:30+00:00

upstream commit: 84b7901f8d5a17536ef2df7fd628ab865df8fe3a

Call phy_disconnect() on remove routine.  Otherwise the phy timer
causes a kernel crash when unloading.

Signed-off-by: Atsushi Nemoto 
Signed-off-by: Jeff Garzik 
Cc: Haavard Skinnemoen 
Signed-off-by: Chris Wright

plip: replace spin_lock_irq with spin_lock_irqsave in irq context

2008-04-19T01:53:28+00:00

upstream commit: cabce28ec0a0ae3d0ddfa4461f0e8be94ade9e46

Plip uses spin_lock_irq/spin_unlock_irq in its IRQ handler (called from
parport IRQ handler), the latter enables interrupts without parport
subsystem IRQ handler expecting it.

The bug can be seen if you compile kernel with lock dependency checking
and use plip --- it produces a warning.

This patch changes it to spin_lock_irqsave/spin_lock_irqrestore, so that
it doesn't enable interrupts when already disabled.

Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright

sis190: read the mac address from the eeprom first

2008-04-19T01:53:27+00:00

upstream commit: 563e0ae06ff18f0b280f11cf706ba0172255ce52

Reading a serie of zero from the cmos sram area do not work
well with is_valid_ether_addr(). Let's read the mac address
from the eeprom first as it seems more reliable.

Fix for http://bugzilla.kernel.org/show_bug.cgi?id=9831

Signed-off-by: Francois Romieu 
Signed-off-by: Jeff Garzik 

dsd@gentoo.org notes:
This patch fixes http://bugs.gentoo.org/207706

Cc: Daniel Drake 
Signed-off-by: Chris Wright

PPPOL2TP: Fix SMP issues in skb reorder queue handling

2008-04-19T01:53:25+00:00

Upstream commit: e653181dd6b3ad38ce14904351b03a5388f4b0f7

When walking a session's packet reorder queue, use
skb_queue_walk_safe() since the list could be modified inside the
loop.

Rearrange the unlinking skbs from the reorder queue such that it is
done while the queue lock is held in pppol2tp_recv_dequeue() when
walking the skb list.

A version of this patch was suggested by Jarek Poplawski.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

PPPOL2TP: Make locking calls softirq-safe

2008-04-19T01:53:25+00:00

Upstream commit: cf3752e2d203bbbfc88d29e362e6938cef4339b3

Fix locking issues in the pppol2tp driver which can cause a kernel
crash on SMP boxes. There were two problems:-

1. The driver was violating read_lock() and write_lock() scheduling
   rules because it wasn't using softirq-safe locks in softirq
   contexts. So we now consistently use the _bh variants of the lock
   functions.

2. The driver was calling sk_dst_get() in pppol2tp_xmit() which was
   taking sk_dst_lock in softirq context. We now call __sk_dst_get().

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

SUNGEM: Fix NAPI assertion failure.

2008-04-19T01:53:24+00:00

Upstream commit: da990a2402aeaee84837f29054c4628eb02f7493

As reported by Johannes Berg:

I started getting this warning with recent kernels:

[  773.908927] ------------[ cut here ]------------
[  773.908954] Badness at net/core/dev.c:2204
 ...

If we loop more than once in gem_poll(), we'll
use more than the real budget in our gem_rx()
calls, thus eventually trigger the caller's
assertions in net_rx_action().

Subtract "work_done" from "budget" for the second
arg to gem_rx() to fix the bug.

Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

macb: Fix speed setting

2008-03-24T18:47:33+00:00

commit: 179956f498bd8cc55fb803c4ee0cf18be59c8b01

Fix NCFGR.SPD setting on 10Mbps.  This bug was introduced by
conversion to generic PHY layer in kernel 2.6.23.

Signed-off-by: Atsushi Nemoto 
Signed-off-by: Jeff Garzik 
Signed-off-by: Haavard Skinnemoen 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

b43: Backport bcm4311 fix

2008-03-24T18:47:31+00:00

This is a backport of upstream commit 013978b6 ("b43: Changes to enable
BCM4311 rev 02 with wireless core revision 13") and the changes include
the following:

(1) Add the 802.11 rev 13 device to the ssb_device_id table to load b43.
(2) Add PHY revision 9 to the supported list.
(3) Change the 2-bit routing code for address extensions to 0b10 rather
    than the 0b01 used for the 32-bit case.
(4) Remove some magic numbers in the DMA setup.

The DMA implementation for this chip supports full 64-bit addressing with
one exception. Whenever the Descriptor Ring Buffer is in high memory, a
fatal DMA error occurs. This problem was not present in 2.6.24-rc2 due
to code to "Bias the placement of kernel pages at lower PFNs". When
commit 44048d70 reverted that code, the DMA error appeared. As a "fix",
use the GFP_DMA flag when allocating the buffer for 64-bit DMA. At present,
this problem is thought to arise from a hardware error.

Signed-off-by: Michael Buesch 
Cc: Larry Finger 
Cc: John W. Linville 
Cc: Alexey Zaytsev 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman