<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/net/usb, branch v2.6.38</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>Added support for usb ethernet (0x0fe6, 0x9700)</title>
<updated>2011-02-23T22:32:28+00:00</updated>
<author>
<name>Shahar Havivi</name>
<email>shaharh@redhat.com</email>
</author>
<published>2011-02-22T04:41:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=67158cebde60edb1a11cf4743f1cb9ded847c5fc'/>
<id>67158cebde60edb1a11cf4743f1cb9ded847c5fc</id>
<content type='text'>
The device is very similar to (0x0fe6, 0x8101),
And works well with dm9601 driver.

Signed-off-by: Shahar Havivi &lt;shaharh@redhat.com&gt;
Acked-by: Peter Korsgaard &lt;jacmet@sunsite.dk&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The device is very similar to (0x0fe6, 0x8101),
And works well with dm9601 driver.

Signed-off-by: Shahar Havivi &lt;shaharh@redhat.com&gt;
Acked-by: Peter Korsgaard &lt;jacmet@sunsite.dk&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Net, USB, Option, hso: Do not dereference NULL pointer</title>
<updated>2011-02-14T00:55:45+00:00</updated>
<author>
<name>Jesper Juhl</name>
<email>jj@chaosbits.net</email>
</author>
<published>2011-02-13T11:15:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=5b89db0e84bef81f6aa324f8f22a9258ff873de3'/>
<id>5b89db0e84bef81f6aa324f8f22a9258ff873de3</id>
<content type='text'>
In drivers/net/usb/hso.c::hso_create_bulk_serial_device() we have this
code:
...
	serial = kzalloc(sizeof(*serial), GFP_KERNEL);
	if (!serial)
		goto exit;
...
exit:
	hso_free_tiomget(serial);
...
hso_free_tiomget() directly dereferences its argument, which in the
example above is a NULL pointer, ouch.
I could just add a 'if (serial)' test at the 'exit' label, but since most
freeing functions in the kernel accept NULL pointers (and it seems like
this was also assumed here) I opted to instead change 'hso_free_tiomget()'
so that it is safe to call it with a NULL argument. I also modified the
function to get rid of a pointles conditional before the call to
'usb_free_urb()' since that function already tests for NULL itself -
besides fixing the NULL deref this change also buys us a few bytes in
size.
Before:
$ size drivers/net/usb/hso.o
   text    data     bss     dec     hex filename
  32200     592    9960   42752    a700 drivers/net/usb/hso.o
After:
$ size drivers/net/usb/hso.o
   text    data     bss     dec     hex filename
  32196     592    9960   42748    a6fc drivers/net/usb/hso.o

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In drivers/net/usb/hso.c::hso_create_bulk_serial_device() we have this
code:
...
	serial = kzalloc(sizeof(*serial), GFP_KERNEL);
	if (!serial)
		goto exit;
...
exit:
	hso_free_tiomget(serial);
...
hso_free_tiomget() directly dereferences its argument, which in the
example above is a NULL pointer, ouch.
I could just add a 'if (serial)' test at the 'exit' label, but since most
freeing functions in the kernel accept NULL pointers (and it seems like
this was also assumed here) I opted to instead change 'hso_free_tiomget()'
so that it is safe to call it with a NULL argument. I also modified the
function to get rid of a pointles conditional before the call to
'usb_free_urb()' since that function already tests for NULL itself -
besides fixing the NULL deref this change also buys us a few bytes in
size.
Before:
$ size drivers/net/usb/hso.o
   text    data     bss     dec     hex filename
  32200     592    9960   42752    a700 drivers/net/usb/hso.o
After:
$ size drivers/net/usb/hso.o
   text    data     bss     dec     hex filename
  32196     592    9960   42748    a6fc drivers/net/usb/hso.o

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB Network driver infrastructure: Fix leak when usb_autopm_get_interface() returns less than zero in kevent().</title>
<updated>2011-02-13T19:21:15+00:00</updated>
<author>
<name>Jesper Juhl</name>
<email>jj@chaosbits.net</email>
</author>
<published>2011-02-10T10:58:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=ab60707ffe9920b66b4fff5181b44b14cd091472'/>
<id>ab60707ffe9920b66b4fff5181b44b14cd091472</id>
<content type='text'>
We'll leak the memory allocated to 'urb' in
drivers/net/usb/usbnet.c:kevent() when we 'goto fail_lowmem' and the 'urb'
variable goes out of scope while still completely unused.

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We'll leak the memory allocated to 'urb' in
drivers/net/usb/usbnet.c:kevent() when we 'goto fail_lowmem' and the 'urb'
variable goes out of scope while still completely unused.

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB CDC NCM errata updates for cdc_ncm host driver</title>
<updated>2011-02-08T21:54:43+00:00</updated>
<author>
<name>Alexey Orishko</name>
<email>alexey.orishko@gmail.com</email>
</author>
<published>2011-02-07T09:45:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=84e77a8bc73cad2f910cc981f266904c66a17825'/>
<id>84e77a8bc73cad2f910cc981f266904c66a17825</id>
<content type='text'>
Specification links:
- CDC NCM errata link:
  http://www.usb.org/developers/devclass_docs/NCM10_012011.zip
- CDC and WMC errata link:
  http://www.usb.org/developers/devclass_docs/CDC1.2_WMC1.1_012011.zip

Changes:
- driver updated to match cdc.h header with errata changes
- added support for USB_CDC_SET_NTB_INPUT_SIZE control request with
  8 byte length
- fixes to comply with specification: send only control requests supported by
  device, set number of datagrams for IN direction, connection speed structure
  update, etc.
- packet loss fixed for tx direction; misleading flag renamed.
- adjusted hard_mtu value.

Signed-off-by: Alexey Orishko &lt;alexey.orishko@stericsson.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Specification links:
- CDC NCM errata link:
  http://www.usb.org/developers/devclass_docs/NCM10_012011.zip
- CDC and WMC errata link:
  http://www.usb.org/developers/devclass_docs/CDC1.2_WMC1.1_012011.zip

Changes:
- driver updated to match cdc.h header with errata changes
- added support for USB_CDC_SET_NTB_INPUT_SIZE control request with
  8 byte length
- fixes to comply with specification: send only control requests supported by
  device, set number of datagrams for IN direction, connection speed structure
  update, etc.
- packet loss fixed for tx direction; misleading flag renamed.
- adjusted hard_mtu value.

Signed-off-by: Alexey Orishko &lt;alexey.orishko@stericsson.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB NET KL5KUSB101: Fix mem leak in error path of kaweth_download_firmware()</title>
<updated>2011-01-25T07:20:24+00:00</updated>
<author>
<name>Jesper Juhl</name>
<email>jj@chaosbits.net</email>
</author>
<published>2011-01-23T12:19:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=986e3f6e2b4582d9a7e61de5090042d5af85da44'/>
<id>986e3f6e2b4582d9a7e61de5090042d5af85da44</id>
<content type='text'>
We will leak the storage allocated by request_firmware() if the size of
the firmware is greater than KAWETH_FIRMWARE_BUF_SIZE.
This removes the leak by calling release_firmware() before we return
-ENOSPC.

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We will leak the storage allocated by request_firmware() if the size of
the firmware is greater than KAWETH_FIRMWARE_BUF_SIZE.
This removes the leak by calling release_firmware() before we return
-ENOSPC.

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB CDC NCM: tx_fixup() race condition fix</title>
<updated>2011-01-19T00:13:50+00:00</updated>
<author>
<name>Alexey Orishko</name>
<email>alexey.orishko@gmail.com</email>
</author>
<published>2011-01-17T07:07:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f742aa8acb7e50a383f6d2b00b1c52e081970d38'/>
<id>f742aa8acb7e50a383f6d2b00b1c52e081970d38</id>
<content type='text'>
- tx_fixup() can be called from either timer callback or from xmit()
  in usbnet, so spinlock is added to avoid concurrency-related problem.
- minor correction due to checkpatch warning for some line over 80
  chars after previous patch was applied.

Signed-off-by: Alexey Orishko &lt;alexey.orishko@stericsson.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
- tx_fixup() can be called from either timer callback or from xmit()
  in usbnet, so spinlock is added to avoid concurrency-related problem.
- minor correction due to checkpatch warning for some line over 80
  chars after previous patch was applied.

Signed-off-by: Alexey Orishko &lt;alexey.orishko@stericsson.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB CDC NCM: Don't deref NULL in cdc_ncm_rx_fixup() and don't use uninitialized variable.</title>
<updated>2011-01-14T05:48:26+00:00</updated>
<author>
<name>Jesper Juhl</name>
<email>jj@chaosbits.net</email>
</author>
<published>2011-01-13T11:40:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=9e56790ad31d72a5a44142af462d047c0c897b29'/>
<id>9e56790ad31d72a5a44142af462d047c0c897b29</id>
<content type='text'>
skb_clone() dynamically allocates memory and may fail. If it does it
returns NULL. This means we'll dereference a NULL pointer in
drivers/net/usb/cdc_ncm.c::cdc_ncm_rx_fixup().
As far as I can tell, the proper way to deal with this is simply to goto
the error label.

Furthermore gcc complains that 'skb' may be used uninitialized:
  drivers/net/usb/cdc_ncm.c: In function ‘cdc_ncm_rx_fixup’:
  drivers/net/usb/cdc_ncm.c:922:18: warning: ‘skb’ may be used uninitialized in this function
and I believe it is right. On the line where we
  pr_debug("invalid frame detected (ignored)" ...
we are using the local variable 'skb' but nothing has ever been assigned
to that variable yet. I believe the correct fix for that is to use
'skb_in' instead.

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
skb_clone() dynamically allocates memory and may fail. If it does it
returns NULL. This means we'll dereference a NULL pointer in
drivers/net/usb/cdc_ncm.c::cdc_ncm_rx_fixup().
As far as I can tell, the proper way to deal with this is simply to goto
the error label.

Furthermore gcc complains that 'skb' may be used uninitialized:
  drivers/net/usb/cdc_ncm.c: In function ‘cdc_ncm_rx_fixup’:
  drivers/net/usb/cdc_ncm.c:922:18: warning: ‘skb’ may be used uninitialized in this function
and I believe it is right. On the line where we
  pr_debug("invalid frame detected (ignored)" ...
we are using the local variable 'skb' but nothing has ever been assigned
to that variable yet. I believe the correct fix for that is to use
'skb_in' instead.

Signed-off-by: Jesper Juhl &lt;jj@chaosbits.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: cdc_ether: remove unneeded check</title>
<updated>2010-12-31T19:11:38+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>error27@gmail.com</email>
</author>
<published>2010-12-25T12:23:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f5260f02e7903bb10e45b1bf3500eab6425edf5c'/>
<id>f5260f02e7903bb10e45b1bf3500eab6425edf5c</id>
<content type='text'>
We already verified that "dev-&gt;udev-&gt;actconfig-&gt;extralen" was non-zero
so "len" is non-zero here as well.

Signed-off-by: Dan Carpenter &lt;error27@gmail.com&gt;
Acked-by: Oliver Neukum &lt;oneukum@suse.de&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We already verified that "dev-&gt;udev-&gt;actconfig-&gt;extralen" was non-zero
so "len" is non-zero here as well.

Signed-off-by: Dan Carpenter &lt;error27@gmail.com&gt;
Acked-by: Oliver Neukum &lt;oneukum@suse.de&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6</title>
<updated>2010-12-27T06:37:05+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2010-12-27T06:37:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=17f7f4d9fcce8f1b75b5f735569309dee7665968'/>
<id>17f7f4d9fcce8f1b75b5f735569309dee7665968</id>
<content type='text'>
Conflicts:
	net/ipv4/fib_frontend.c
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Conflicts:
	net/ipv4/fib_frontend.c
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: mcs7830: return negative if auto negotiate fails</title>
<updated>2010-12-23T18:21:12+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>error27@gmail.com</email>
</author>
<published>2010-12-17T03:25:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=0e214ad81545a35c5e62a4c2d6cf7275fd7a545f'/>
<id>0e214ad81545a35c5e62a4c2d6cf7275fd7a545f</id>
<content type='text'>
The original code returns 0 on success and 1 on failure.  In fact, at
this point, "ret" is already either zero or a negative error code so
we can just return it directly.

Signed-off-by: Dan Carpenter &lt;error27@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The original code returns 0 on success and 1 on failure.  In fact, at
this point, "ret" is already either zero or a negative error code so
we can just return it directly.

Signed-off-by: Dan Carpenter &lt;error27@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
