From 3d4bd24b019981394fabb465b0c7932924b83d65 Mon Sep 17 00:00:00 2001 From: Florin Malita Date: Fri, 18 May 2007 16:04:33 -0400 Subject: [PATCH 01/12] [PATCH] libertas: skb dereferenced after netif_rx In libertas_process_rxed_packet() and process_rxed_802_11_packet() the skb is dereferenced after being passed to netif_rx (called from libertas_upload_rx_packet). Spotted by Coverity (1658, 1659). Also, libertas_upload_rx_packet() unconditionally returns 0 so the error check is dead code - might as well take it out and change the signature. Signed-off-by: Florin Malita Signed-off-by: John W. Linville --- drivers/net/wireless/libertas/decl.h | 2 +- drivers/net/wireless/libertas/rx.c | 22 +++++----------------- 2 files changed, 6 insertions(+), 18 deletions(-) diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h index 606bdd002be7..dfe27642322c 100644 --- a/drivers/net/wireless/libertas/decl.h +++ b/drivers/net/wireless/libertas/decl.h @@ -46,7 +46,7 @@ u32 libertas_index_to_data_rate(u8 index); u8 libertas_data_rate_to_index(u32 rate); void libertas_get_fwversion(wlan_adapter * adapter, char *fwversion, int maxlen); -int libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb); +void libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb); /** The proc fs interface */ int libertas_process_rx_command(wlan_private * priv); diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c index d17924f764e5..b19b5aa8713b 100644 --- a/drivers/net/wireless/libertas/rx.c +++ b/drivers/net/wireless/libertas/rx.c @@ -136,7 +136,7 @@ static void wlan_compute_rssi(wlan_private * priv, struct rxpd *p_rx_pd) LEAVE(); } -int libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb) +void libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb) { lbs_pr_debug(1, "skb->data=%p\n", skb->data); @@ -148,8 +148,6 @@ int libertas_upload_rx_packet(wlan_private * priv, struct sk_buff *skb) skb->ip_summed = CHECKSUM_UNNECESSARY; netif_rx(skb); - - return 0; } /** @@ -269,15 +267,11 @@ int libertas_process_rxed_packet(wlan_private * priv, struct sk_buff *skb) wlan_compute_rssi(priv, p_rx_pd); lbs_pr_debug(1, "RX Data: size of actual packet = %d\n", skb->len); - if (libertas_upload_rx_packet(priv, skb)) { - lbs_pr_debug(1, "RX error: libertas_upload_rx_packet" - " returns failure\n"); - ret = -1; - goto done; - } priv->stats.rx_bytes += skb->len; priv->stats.rx_packets++; + libertas_upload_rx_packet(priv, skb); + ret = 0; done: LEAVE(); @@ -438,17 +432,11 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct sk_buff *skb) wlan_compute_rssi(priv, prxpd); lbs_pr_debug(1, "RX Data: size of actual packet = %d\n", skb->len); - - if (libertas_upload_rx_packet(priv, skb)) { - lbs_pr_debug(1, "RX error: libertas_upload_rx_packet " - "returns failure\n"); - ret = -1; - goto done; - } - priv->stats.rx_bytes += skb->len; priv->stats.rx_packets++; + libertas_upload_rx_packet(priv, skb); + ret = 0; done: LEAVE(); From 596f2d0554352f1089f7478b309b27d8cdf5cd4f Mon Sep 17 00:00:00 2001 From: Eugene Teo Date: Sat, 19 May 2007 11:09:20 +0800 Subject: [PATCH 02/12] [PATCH] drivers/net/wireless/libertas/fw.c: fix use-before-check NULL checks should be performed before the dereference. Spotted by the Coverity checker. Signed-off-by: Eugene Teo Signed-off-by: John W. Linville --- drivers/net/wireless/libertas/fw.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/libertas/fw.c b/drivers/net/wireless/libertas/fw.c index 441123c85e62..5c63c9b1659c 100644 --- a/drivers/net/wireless/libertas/fw.c +++ b/drivers/net/wireless/libertas/fw.c @@ -333,18 +333,22 @@ static void command_timer_fn(unsigned long data) unsigned long flags; ptempnode = adapter->cur_cmd; + if (ptempnode == NULL) { + lbs_pr_debug(1, "PTempnode Empty\n"); + return; + } + cmd = (struct cmd_ds_command *)ptempnode->bufvirtualaddr; + if (!cmd) { + lbs_pr_debug(1, "cmd is NULL\n"); + return; + } lbs_pr_info("command_timer_fn fired (%x)\n", cmd->command); if (!adapter->fw_ready) return; - if (ptempnode == NULL) { - lbs_pr_debug(1, "PTempnode Empty\n"); - return; - } - spin_lock_irqsave(&adapter->driver_lock, flags); adapter->cur_cmd = NULL; spin_unlock_irqrestore(&adapter->driver_lock, flags); From 412e8a0ebf1a58c060cc76438e5b6d33789c5e20 Mon Sep 17 00:00:00 2001 From: Eugene Teo Date: Mon, 21 May 2007 22:30:22 +0800 Subject: [PATCH 03/12] [PATCH] drivers/net/wireless/libertas/rx.c: fix use-after-free skb could have been freed by then. Also, in libertas_upload_rx_packet(), skb->protocol is initialized by eth_type_trans(). Signed-off-by: Eugene Teo Signed-off-by: John W. Linville --- drivers/net/wireless/libertas/rx.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c index b19b5aa8713b..96619a32951b 100644 --- a/drivers/net/wireless/libertas/rx.c +++ b/drivers/net/wireless/libertas/rx.c @@ -441,7 +441,5 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct sk_buff *skb) done: LEAVE(); - skb->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */ - return (ret); } From 5bc8d39a4759e956fa25880d57ef579f96f1a334 Mon Sep 17 00:00:00 2001 From: Li Yang Date: Tue, 22 May 2007 20:24:37 +0800 Subject: [PATCH 04/12] ucc_geth: Fix MODULE_DEVICE_TABLE() duplication Fix MODULE_DEVICE_TABLE() duplication in ucc_geth.c and ucc_geth_mii.c for ucc_geth to be compiled as module. Signed-off-by: Li Yang Signed-off-by: Jeff Garzik --- drivers/net/ucc_geth_mii.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c index f96966d4bcc2..7bcb82f50cf7 100644 --- a/drivers/net/ucc_geth_mii.c +++ b/drivers/net/ucc_geth_mii.c @@ -260,8 +260,6 @@ static struct of_device_id uec_mdio_match[] = { {}, }; -MODULE_DEVICE_TABLE(of, uec_mdio_match); - static struct of_platform_driver uec_mdio_driver = { .name = DRV_NAME, .probe = uec_mdio_probe, From 66bd23fad81fb0b84c16edd48ec160f8fdbe3f57 Mon Sep 17 00:00:00 2001 From: Li Yang Date: Tue, 22 May 2007 20:34:14 +0800 Subject: [PATCH 05/12] ucc_geth:trivial fix Remove redundant includes. Signed-off-by: Li Yang Signed-off-by: Jeff Garzik --- drivers/net/ucc_geth.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c index c2ccbd098f53..18b731bb4da1 100644 --- a/drivers/net/ucc_geth.c +++ b/drivers/net/ucc_geth.c @@ -23,11 +23,8 @@ #include #include #include -#include -#include #include #include -#include #include #include #include From 2ed22bc294315d19aa1f0423b83d21a2d94c641b Mon Sep 17 00:00:00 2001 From: David Hollis Date: Wed, 23 May 2007 07:33:17 -0400 Subject: [PATCH 06/12] asix.c - Add Belkin F5D5055 ids (Originally sent to linux-usb-devel) The attached patch adds the device IDs for the Belkin F5D5055 device. Reported by Andy Juniper Signed-off-by: David Hollis -- David Hollis Signed-off-by: Jeff Garzik --- drivers/net/usb/asix.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c index d5ef97bc4d01..6d95cacd5284 100644 --- a/drivers/net/usb/asix.c +++ b/drivers/net/usb/asix.c @@ -1458,6 +1458,10 @@ static const struct usb_device_id products [] = { // IO-DATA ETG-US2 USB_DEVICE (0x04bb, 0x0930), .driver_info = (unsigned long) &ax88178_info, +}, { + // Belkin F5D5055 + USB_DEVICE(0x050d, 0x5055), + .driver_info = (unsigned long) &ax88178_info, }, { }, // END }; From 239dc572b8e6ecde91afe96d2426ddc2afd4695d Mon Sep 17 00:00:00 2001 From: Denver Gingerich Date: Wed, 23 May 2007 14:34:43 -0700 Subject: [PATCH 07/12] fix compiler warning in fixed.c Correct the following compiler warning (and warnings resulting from the correction): warning: 'fixed_mdio_register_device' defined but not used Signed-off-by: Denver Gingerich Cc: Vitaly Bordug Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/phy/fixed.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/phy/fixed.c b/drivers/net/phy/fixed.c index 68c99b4c5255..bb966911a137 100644 --- a/drivers/net/phy/fixed.c +++ b/drivers/net/phy/fixed.c @@ -89,6 +89,7 @@ EXPORT_SYMBOL(fixed_mdio_set_link_update); /*----------------------------------------------------------------------------- * This is used for updating internal mii regs from the status *-----------------------------------------------------------------------------*/ +#if defined(CONFIG_FIXED_MII_100_FDX) || defined(CONFIG_FIXED_MII_10_FDX) static int fixed_mdio_update_regs(struct fixed_info *fixed) { u16 *regs = fixed->regs; @@ -165,6 +166,7 @@ static int fixed_mii_reset(struct mii_bus *bus) /*nothing here - no way/need to reset it*/ return 0; } +#endif static int fixed_config_aneg(struct phy_device *phydev) { @@ -194,6 +196,7 @@ static struct phy_driver fixed_mdio_driver = { * number is used to create multiple fixed PHYs, so that several devices can * utilize them simultaneously. *-----------------------------------------------------------------------------*/ +#if defined(CONFIG_FIXED_MII_100_FDX) || defined(CONFIG_FIXED_MII_10_FDX) static int fixed_mdio_register_device(int number, int speed, int duplex) { struct mii_bus *new_bus; @@ -301,6 +304,7 @@ static int fixed_mdio_register_device(int number, int speed, int duplex) return err; } +#endif MODULE_DESCRIPTION("Fixed PHY device & driver for PAL"); From 73815538e642de66a5607cc16d13004ecb1a3062 Mon Sep 17 00:00:00 2001 From: Yoichi Yuasa Date: Thu, 24 May 2007 16:12:27 +0900 Subject: [PATCH 08/12] remove unnecessary dependency on VIA velocity config Hi, This patch has removed unnecessary dependency on VIA velocity config. Yoichi Signed-off-by: Yoichi Yuasa Signed-off-by: Jeff Garzik --- drivers/net/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig index c5baa197bc08..30fd479fea5e 100644 --- a/drivers/net/Kconfig +++ b/drivers/net/Kconfig @@ -2218,7 +2218,7 @@ config SK98LIN config VIA_VELOCITY tristate "VIA Velocity support" - depends on NET_PCI && PCI + depends on PCI select CRC32 select CRC_CCITT select MII From e971290133d8151c468cd70206fedc92648feb58 Mon Sep 17 00:00:00 2001 From: Ralf Baechle Date: Thu, 24 May 2007 12:54:04 +0100 Subject: [PATCH 09/12] meth driver renovation The meth ethernet driver for the SGI IP32 aka O2 is so far still an old style driver which does not use the device driver model. This is now causing issues with some udev based gadgetry in debian-stable. Fixed by converting the meth driver to a platform device. Signed-off-by: Ralf Baechle -- Fixes since previous patch: o Fixed typo in meth_exit_module() Signed-off-by: Jeff Garzik --- arch/mips/sgi-ip32/Makefile | 2 +- arch/mips/sgi-ip32/ip32-platform.c | 20 +++++++++ drivers/net/meth.c | 68 ++++++++++++++++++++---------- 3 files changed, 66 insertions(+), 24 deletions(-) create mode 100644 arch/mips/sgi-ip32/ip32-platform.c diff --git a/arch/mips/sgi-ip32/Makefile b/arch/mips/sgi-ip32/Makefile index 7e1416768a60..60f0227425e7 100644 --- a/arch/mips/sgi-ip32/Makefile +++ b/arch/mips/sgi-ip32/Makefile @@ -3,5 +3,5 @@ # under Linux. # -obj-y += ip32-berr.o ip32-irq.o ip32-setup.o ip32-reset.o \ +obj-y += ip32-berr.o ip32-irq.o ip32-platform.o ip32-setup.o ip32-reset.o \ crime.o ip32-memory.o diff --git a/arch/mips/sgi-ip32/ip32-platform.c b/arch/mips/sgi-ip32/ip32-platform.c new file mode 100644 index 000000000000..120b15932caf --- /dev/null +++ b/arch/mips/sgi-ip32/ip32-platform.c @@ -0,0 +1,20 @@ +#include +#include + +static __init int meth_devinit(void) +{ + struct platform_device *pd; + int ret; + + pd = platform_device_alloc("meth", -1); + if (!pd) + return -ENOMEM; + + ret = platform_device_add(pd); + if (ret) + platform_device_put(pd); + + return ret; +} + +device_initcall(meth_devinit); diff --git a/drivers/net/meth.c b/drivers/net/meth.c index 0343ea12b299..92b403bf38b0 100644 --- a/drivers/net/meth.c +++ b/drivers/net/meth.c @@ -8,15 +8,16 @@ * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. */ -#include -#include - -#include /* printk() */ #include +#include +#include +#include +#include +#include #include -#include /* error codes */ -#include /* size_t */ -#include /* mark_bh */ +#include +#include +#include #include #include @@ -33,7 +34,6 @@ #include #include -#include #include "meth.h" @@ -51,8 +51,6 @@ static const char *meth_str="SGI O2 Fast Ethernet"; -MODULE_AUTHOR("Ilya Volynets "); -MODULE_DESCRIPTION("SGI O2 Builtin Fast Ethernet driver"); #define HAVE_TX_TIMEOUT /* The maximum time waited (in jiffies) before assuming a Tx failed. (400ms) */ @@ -784,15 +782,15 @@ static struct net_device_stats *meth_stats(struct net_device *dev) /* * The init function. */ -static struct net_device *meth_init(void) +static int __init meth_probe(struct platform_device *pdev) { struct net_device *dev; struct meth_private *priv; - int ret; + int err; dev = alloc_etherdev(sizeof(struct meth_private)); if (!dev) - return ERR_PTR(-ENOMEM); + return -ENOMEM; dev->open = meth_open; dev->stop = meth_release; @@ -808,11 +806,12 @@ static struct net_device *meth_init(void) priv = netdev_priv(dev); spin_lock_init(&priv->meth_lock); + SET_NETDEV_DEV(dev, &pdev->dev); - ret = register_netdev(dev); - if (ret) { + err = register_netdev(dev); + if (err) { free_netdev(dev); - return ERR_PTR(ret); + return err; } printk(KERN_INFO "%s: SGI MACE Ethernet rev. %d\n", @@ -820,21 +819,44 @@ static struct net_device *meth_init(void) return 0; } -static struct net_device *meth_dev; +static int __exit meth_remove(struct platform_device *pdev) +{ + struct net_device *dev = platform_get_drvdata(pdev); + + unregister_netdev(dev); + free_netdev(dev); + platform_set_drvdata(pdev, NULL); + + return 0; +} + +static struct platform_driver meth_driver = { + .probe = meth_probe, + .remove = __devexit_p(meth_remove), + .driver = { + .name = "meth", + } +}; static int __init meth_init_module(void) { - meth_dev = meth_init(); - if (IS_ERR(meth_dev)) - return PTR_ERR(meth_dev); - return 0; + int err; + + err = platform_driver_register(&meth_driver); + if (err) + printk(KERN_ERR "Driver registration failed\n"); + + return err; } static void __exit meth_exit_module(void) { - unregister_netdev(meth_dev); - free_netdev(meth_dev); + platform_driver_unregister(&meth_driver); } module_init(meth_init_module); module_exit(meth_exit_module); + +MODULE_AUTHOR("Ilya Volynets "); +MODULE_DESCRIPTION("SGI O2 Builtin Fast Ethernet driver"); +MODULE_LICENSE("GPL"); From 93c1d3b790673bb2a7489d6f165c5c99a7f44baf Mon Sep 17 00:00:00 2001 From: Florin Malita Date: Tue, 22 May 2007 18:09:42 -0500 Subject: [PATCH 10/12] spidernet: skb used after netif_receive_skb The stats update code in spider_net_pass_skb_up() is touching the skb after it's been passed up to the stack. To avoid that, just update the stats first. Signed-off-by: Florin Malita Signed-off-by: Linas Vepstas Signed-off-by: Jeff Garzik --- drivers/net/spider_net.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c index c3964c3d89d9..ef84d7c757a0 100644 --- a/drivers/net/spider_net.c +++ b/drivers/net/spider_net.c @@ -1014,12 +1014,12 @@ spider_net_pass_skb_up(struct spider_net_descr *descr, */ } - /* pass skb up to stack */ - netif_receive_skb(skb); - /* update netdevice statistics */ card->netdev_stats.rx_packets++; card->netdev_stats.rx_bytes += skb->len; + + /* pass skb up to stack */ + netif_receive_skb(skb); } #ifdef DEBUG From 294cf1b880fad9221e911fb2ce07b1fff3ae1a3d Mon Sep 17 00:00:00 2001 From: Mariusz Kozlowski Date: Thu, 24 May 2007 19:46:14 +0200 Subject: [PATCH 11/12] chelsio parenthesis fix Hello, Balanance parenthesis in chelsio header file. Signed-off-by: Mariusz Kozlowski drivers/net/chelsio/suni1x10gexp_regs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Signed-off-by: Jeff Garzik --- drivers/net/chelsio/suni1x10gexp_regs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/chelsio/suni1x10gexp_regs.h b/drivers/net/chelsio/suni1x10gexp_regs.h index 269d097dd927..d0f87d82566a 100644 --- a/drivers/net/chelsio/suni1x10gexp_regs.h +++ b/drivers/net/chelsio/suni1x10gexp_regs.h @@ -105,7 +105,7 @@ #define mSUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_LOW(filterId) (0x204A + mSUNI1x10GEXP_MAC_FILTER_OFFSET(filterId)) #define mSUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_MID(filterId) (0x204B + mSUNI1x10GEXP_MAC_FILTER_OFFSET(filterId)) #define mSUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_HIGH(filterId)(0x204C + mSUNI1x10GEXP_MAC_FILTER_OFFSET(filterId)) -#define mSUNI1x10GEXP_REG_RXXG_EXACT_MATCH_VID(filterId) (0x2062 + mSUNI1x10GEXP_MAC_VID_FILTER_OFFSET(filterId) +#define mSUNI1x10GEXP_REG_RXXG_EXACT_MATCH_VID(filterId) (0x2062 + mSUNI1x10GEXP_MAC_VID_FILTER_OFFSET(filterId)) #define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_0_LOW 0x204A #define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_0_MID 0x204B #define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_0_HIGH 0x204C From 096a458c3a9c717563e98b0a2ce69821459a6660 Mon Sep 17 00:00:00 2001 From: Ayaz Abdulla Date: Mon, 21 May 2007 20:23:11 -0400 Subject: [PATCH 12/12] forcedeth: fix cpu irq mask This patch fixes the cpu irq mask define to include the timer irq. Another flag check was setting up the timer bit in all cases so we didn't notice the issue. Signed-off-by: Ayaz Abdulla Signed-off-by: Jeff Garzik --- drivers/net/forcedeth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c index 7a018027fcc0..4154fd000746 100644 --- a/drivers/net/forcedeth.c +++ b/drivers/net/forcedeth.c @@ -195,7 +195,7 @@ enum { #define NVREG_IRQ_TX_FORCED 0x0100 #define NVREG_IRQ_RECOVER_ERROR 0x8000 #define NVREG_IRQMASK_THROUGHPUT 0x00df -#define NVREG_IRQMASK_CPU 0x0040 +#define NVREG_IRQMASK_CPU 0x0060 #define NVREG_IRQ_TX_ALL (NVREG_IRQ_TX_ERR|NVREG_IRQ_TX_OK|NVREG_IRQ_TX_FORCED) #define NVREG_IRQ_RX_ALL (NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF|NVREG_IRQ_RX_FORCED) #define NVREG_IRQ_OTHER (NVREG_IRQ_TIMER|NVREG_IRQ_LINK|NVREG_IRQ_RECOVER_ERROR)