Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9cfe8648 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: SNMP NAT: fix memory corruption
  [IRDA]: fixup type of ->lsap_state
  [IRDA]: fix 16/32 bit confusion
  [NET]: Fix "ntohl(ntohs" bugs
  [BNX2]: Use kmalloc instead of array
  [BNX2]: Fix bug in bnx2_nvram_write()
  [TG3]: Add some missing rx error counters
parents fd0ff8aa f41d5bb1

drivers/net/bnx2.c

+15 −5
Original line number Diff line number Diff line
@@ -55,8 +55,8 @@ 


#define DRV_MODULE_NAME		"bnx2"

#define PFX DRV_MODULE_NAME	": "

#define DRV_MODULE_VERSION	"1.4.39"

#define DRV_MODULE_RELDATE	"March 22, 2006"

#define DRV_MODULE_VERSION	"1.4.40"

#define DRV_MODULE_RELDATE	"May 22, 2006"



#define RUN_AT(x) (jiffies + (x))
@@ -2945,7 +2945,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, 
		int buf_size)

{

	u32 written, offset32, len32;

	u8 *buf, start[4], end[4];

	u8 *buf, start[4], end[4], *flash_buffer = NULL;

	int rc = 0;

	int align_start, align_end;
@@ -2985,12 +2985,19 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, 
		memcpy(buf + align_start, data_buf, buf_size);

	}



	if (bp->flash_info->buffered == 0) {

		flash_buffer = kmalloc(264, GFP_KERNEL);

		if (flash_buffer == NULL) {

			rc = -ENOMEM;

			goto nvram_write_end;

		}

	}



	written = 0;

	while ((written < len32) && (rc == 0)) {

		u32 page_start, page_end, data_start, data_end;

		u32 addr, cmd_flags;

		int i;

		u8 flash_buffer[264];



	        /* Find the page_start addr */

		page_start = offset32 + written;
@@ -3061,7 +3068,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, 
		}



		/* Loop to write the new data from data_start to data_end */

		for (addr = data_start; addr < data_end; addr += 4, i++) {

		for (addr = data_start; addr < data_end; addr += 4, i += 4) {

			if ((addr == page_end - 4) ||

				((bp->flash_info->buffered) &&

				 (addr == data_end - 4))) {
@@ -3109,6 +3116,9 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, 
	}



nvram_write_end:

	if (bp->flash_info->buffered == 0)

		kfree(flash_buffer);



	if (align_start || align_end)

		kfree(buf);

	return rc;

drivers/net/tg3.c

+6 −2
Original line number Diff line number Diff line
@@ -69,8 +69,8 @@ 


#define DRV_MODULE_NAME		"tg3"

#define PFX DRV_MODULE_NAME	": "

#define DRV_MODULE_VERSION	"3.57"

#define DRV_MODULE_RELDATE	"Apr 28, 2006"

#define DRV_MODULE_VERSION	"3.58"

#define DRV_MODULE_RELDATE	"May 22, 2006"



#define TG3_DEF_MAC_MODE	0

#define TG3_DEF_RX_MODE		0
@@ -6488,6 +6488,10 @@ static void tg3_periodic_fetch_stats(struct tg3 *tp) 
	TG3_STAT_ADD32(&sp->rx_frame_too_long_errors, MAC_RX_STATS_FRAME_TOO_LONG);

	TG3_STAT_ADD32(&sp->rx_jabbers, MAC_RX_STATS_JABBERS);

	TG3_STAT_ADD32(&sp->rx_undersize_packets, MAC_RX_STATS_UNDERSIZE);



	TG3_STAT_ADD32(&sp->rxbds_empty, RCVLPC_NO_RCV_BD_CNT);

	TG3_STAT_ADD32(&sp->rx_discards, RCVLPC_IN_DISCARDS_CNT);

	TG3_STAT_ADD32(&sp->rx_errors, RCVLPC_IN_ERRORS_CNT);

}



static void tg3_timer(unsigned long __opaque)

include/net/irda/irlmp.h

+1 −1
Original line number Diff line number Diff line
@@ -112,7 +112,7 @@ struct lsap_cb { 


	struct timer_list watchdog_timer;



	IRLMP_STATE     lsap_state;  /* Connection state */

	LSAP_STATE      lsap_state;  /* Connection state */

	notify_t        notify;      /* Indication/Confirm entry points */

	struct qos_info qos;         /* QoS for this connection */

net/ipv4/ipcomp.c

+1 −1
Original line number Diff line number Diff line
@@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info) 
	    skb->h.icmph->code != ICMP_FRAG_NEEDED)

		return;



	spi = ntohl(ntohs(ipch->cpi));

	spi = htonl(ntohs(ipch->cpi));

	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,

	                      spi, IPPROTO_COMP, AF_INET);

	if (!x)

net/ipv4/netfilter/ip_nat_snmp_basic.c

+7 −8
Original line number Diff line number Diff line
@@ -1003,12 +1003,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx, 
		

	return 1;



err_id_free:

	kfree(trap->id);



err_addr_free:

	kfree((unsigned long *)trap->ip_address);



err_id_free:

	kfree(trap->id);



	return 0;

}
@@ -1126,11 +1126,10 @@ static int snmp_parse_mangle(unsigned char *msg, 
		struct snmp_v1_trap trap;

		unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);

		

		/* Discard trap allocations regardless */

		if (ret) {

			kfree(trap.id);

			kfree((unsigned long *)trap.ip_address);

		

		if (!ret)

		} else 

			return ret;

		

	} else {