tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[NETFILTER]: SNMP NAT: fix memory corruption
[IRDA]: fixup type of ->lsap_state
[IRDA]: fix 16/32 bit confusion
[NET]: Fix "ntohl(ntohs" bugs
[BNX2]: Use kmalloc instead of array
[BNX2]: Fix bug in bnx2_nvram_write()
[TG3]: Add some missing rx error counters

Linus Torvalds 9cfe8648 fd0ff8aa

+35 -21
+15 -5
drivers/net/bnx2.c
··· 55 55 56 56 #define DRV_MODULE_NAME "bnx2" 57 57 #define PFX DRV_MODULE_NAME ": " 58 - #define DRV_MODULE_VERSION "1.4.39" 59 - #define DRV_MODULE_RELDATE "March 22, 2006" 58 + #define DRV_MODULE_VERSION "1.4.40" 59 + #define DRV_MODULE_RELDATE "May 22, 2006" 60 60 61 61 #define RUN_AT(x) (jiffies + (x)) 62 62 ··· 2945 2945 int buf_size) 2946 2946 { 2947 2947 u32 written, offset32, len32; 2948 - u8 *buf, start[4], end[4]; 2948 + u8 *buf, start[4], end[4], *flash_buffer = NULL; 2949 2949 int rc = 0; 2950 2950 int align_start, align_end; 2951 2951 ··· 2985 2985 memcpy(buf + align_start, data_buf, buf_size); 2986 2986 } 2987 2987 2988 + if (bp->flash_info->buffered == 0) { 2989 + flash_buffer = kmalloc(264, GFP_KERNEL); 2990 + if (flash_buffer == NULL) { 2991 + rc = -ENOMEM; 2992 + goto nvram_write_end; 2993 + } 2994 + } 2995 + 2988 2996 written = 0; 2989 2997 while ((written < len32) && (rc == 0)) { 2990 2998 u32 page_start, page_end, data_start, data_end; 2991 2999 u32 addr, cmd_flags; 2992 3000 int i; 2993 - u8 flash_buffer[264]; 2994 3001 2995 3002 /* Find the page_start addr */ 2996 3003 page_start = offset32 + written; ··· 3068 3061 } 3069 3062 3070 3063 /* Loop to write the new data from data_start to data_end */ 3071 - for (addr = data_start; addr < data_end; addr += 4, i++) { 3064 + for (addr = data_start; addr < data_end; addr += 4, i += 4) { 3072 3065 if ((addr == page_end - 4) || 3073 3066 ((bp->flash_info->buffered) && 3074 3067 (addr == data_end - 4))) { ··· 3116 3109 } 3117 3110 3118 3111 nvram_write_end: 3112 + if (bp->flash_info->buffered == 0) 3113 + kfree(flash_buffer); 3114 + 3119 3115 if (align_start || align_end) 3120 3116 kfree(buf); 3121 3117 return rc;
+6 -2
drivers/net/tg3.c
··· 69 69 70 70 #define DRV_MODULE_NAME "tg3" 71 71 #define PFX DRV_MODULE_NAME ": " 72 - #define DRV_MODULE_VERSION "3.57" 73 - #define DRV_MODULE_RELDATE "Apr 28, 2006" 72 + #define DRV_MODULE_VERSION "3.58" 73 + #define DRV_MODULE_RELDATE "May 22, 2006" 74 74 75 75 #define TG3_DEF_MAC_MODE 0 76 76 #define TG3_DEF_RX_MODE 0 ··· 6488 6488 TG3_STAT_ADD32(&sp->rx_frame_too_long_errors, MAC_RX_STATS_FRAME_TOO_LONG); 6489 6489 TG3_STAT_ADD32(&sp->rx_jabbers, MAC_RX_STATS_JABBERS); 6490 6490 TG3_STAT_ADD32(&sp->rx_undersize_packets, MAC_RX_STATS_UNDERSIZE); 6491 + 6492 + TG3_STAT_ADD32(&sp->rxbds_empty, RCVLPC_NO_RCV_BD_CNT); 6493 + TG3_STAT_ADD32(&sp->rx_discards, RCVLPC_IN_DISCARDS_CNT); 6494 + TG3_STAT_ADD32(&sp->rx_errors, RCVLPC_IN_ERRORS_CNT); 6491 6495 } 6492 6496 6493 6497 static void tg3_timer(unsigned long __opaque)
+1 -1
include/net/irda/irlmp.h
··· 112 112 113 113 struct timer_list watchdog_timer; 114 114 115 - IRLMP_STATE lsap_state; /* Connection state */ 115 + LSAP_STATE lsap_state; /* Connection state */ 116 116 notify_t notify; /* Indication/Confirm entry points */ 117 117 struct qos_info qos; /* QoS for this connection */ 118 118
+1 -1
net/ipv4/ipcomp.c
··· 210 210 skb->h.icmph->code != ICMP_FRAG_NEEDED) 211 211 return; 212 212 213 - spi = ntohl(ntohs(ipch->cpi)); 213 + spi = htonl(ntohs(ipch->cpi)); 214 214 x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, 215 215 spi, IPPROTO_COMP, AF_INET); 216 216 if (!x)
+7 -8
net/ipv4/netfilter/ip_nat_snmp_basic.c
··· 1003 1003 1004 1004 return 1; 1005 1005 1006 + err_addr_free: 1007 + kfree((unsigned long *)trap->ip_address); 1008 + 1006 1009 err_id_free: 1007 1010 kfree(trap->id); 1008 1011 1009 - err_addr_free: 1010 - kfree((unsigned long *)trap->ip_address); 1011 - 1012 1012 return 0; 1013 1013 } 1014 1014 ··· 1126 1126 struct snmp_v1_trap trap; 1127 1127 unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check); 1128 1128 1129 - /* Discard trap allocations regardless */ 1130 - kfree(trap.id); 1131 - kfree((unsigned long *)trap.ip_address); 1132 - 1133 - if (!ret) 1129 + if (ret) { 1130 + kfree(trap.id); 1131 + kfree((unsigned long *)trap.ip_address); 1132 + } else 1134 1133 return ret; 1135 1134 1136 1135 } else {
+1 -1
net/ipv4/xfrm4_policy.c
··· 221 221 if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 222 222 u16 *ipcomp_hdr = (u16 *)xprth; 223 223 224 - fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1])); 224 + fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); 225 225 } 226 226 break; 227 227 default:
+1 -1
net/ipv6/ipcomp6.c
··· 208 208 if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG) 209 209 return; 210 210 211 - spi = ntohl(ntohs(ipcomph->cpi)); 211 + spi = htonl(ntohs(ipcomph->cpi)); 212 212 x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6); 213 213 if (!x) 214 214 return;
+2 -1
net/irda/iriap.c
··· 544 544 { 545 545 struct sk_buff *tx_skb; 546 546 int n; 547 - __u32 tmp_be32, tmp_be16; 547 + __u32 tmp_be32; 548 + __be16 tmp_be16; 548 549 __u8 *fp; 549 550 550 551 IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
+1 -1
net/xfrm/xfrm_input.c
··· 62 62 case IPPROTO_COMP: 63 63 if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr))) 64 64 return -EINVAL; 65 - *spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2))); 65 + *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2))); 66 66 *seq = 0; 67 67 return 0; 68 68 default: