* [net-next-2.6 PATCH 9/9] vxge: return PCI_ERS_RESULT_DISCONNECT on permanent failure
From: Dean Nelson @ 2009-07-31 19:14 UTC (permalink / raw)
To: netdev; +Cc: Ramkrishna Vepa
In-Reply-To: <20090731191254.5470.99642.send-patch@aqua>
PCI drivers that implement the struct pci_error_handlers' error_detected
callback should return PCI_ERS_RESULT_DISCONNECT if the state passed in is
pci_channel_io_perm_failure. This patch fixes the issue for vxge.
Signed-off-by: Dean Nelson <dnelson@redhat.com>
---
This patch has not been tested, since I don't have the hardware to test it.
It is based on a few recent patches. See the following commits:
http://git.kernel.org/linus/c93b5a76d58656158d195a7df507ebc660010969
http://git.kernel.org/linus/eab633021c26025b34f36f79f0311d3d99f40ceb
http://git.kernel.org/linus/ef681ce1e8b3e63317cd724c200b2fd39286c005
http://git.kernel.org/linus/59ed6eecff4aa00c5c5d18ffd180acac108d596e
http://git.kernel.org/linus/3044b8d1ff8c05237652a692fb572a34e4d70146
drivers/net/vxge/vxge-main.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index 7b5402b..335140d 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -3956,6 +3956,9 @@ static pci_ers_result_t vxge_io_error_detected(struct pci_dev *pdev,
netif_device_detach(netdev);
+ if (state == pci_channel_io_perm_failure)
+ return PCI_ERS_RESULT_DISCONNECT;
+
if (netif_running(netdev)) {
/* Bring down the card, while avoiding PCI I/O */
do_vxge_close(netdev, 0);
^ permalink raw reply related
* Re: [PATCH 2/2] c/r: Add AF_INET support (v3)
From: John Dykstra @ 2009-07-31 19:35 UTC (permalink / raw)
To: Dan Smith; +Cc: containers, netdev, Oren Laaden, Alexey Dobriyan
In-Reply-To: <1246994776-1882-3-git-send-email-danms@us.ibm.com>
On Tue, 2009-07-07 at 12:26 -0700, Dan Smith wrote:
> + CKPT_COPY(op, hh->tcp.last_synq_overflow, sk->last_synq_overflow);
This sock field was removed from the mainline kernel by commit
a0f82f64e26929776c58a5c93c2ecb38e3d82815.
-- John
^ permalink raw reply
* Re: [PATCH 2/2] c/r: Add AF_INET support (v3)
From: Dan Smith @ 2009-07-31 19:40 UTC (permalink / raw)
To: John Dykstra; +Cc: containers, netdev, Oren Laaden, Alexey Dobriyan
In-Reply-To: <1249068948.1104.0.camel@Maple>
>> + CKPT_COPY(op, hh->tcp.last_synq_overflow, sk->last_synq_overflow);
JD> This sock field was removed from the mainline kernel by commit
JD> a0f82f64e26929776c58a5c93c2ecb38e3d82815.
Ah, thanks for this. I'm trying to get the UNIX patch updated with
the latest round of feedback and then I'll take this and the other
comments forward with the INET patch.
Thanks!
--
Dan Smith
IBM Linux Technology Center
email: danms@us.ibm.com
^ permalink raw reply
* Re: [net-next-2.6 PATCH 6/9] ixgb: return PCI_ERS_RESULT_DISCONNECT on permanent failure
From: Waskiewicz Jr, Peter P @ 2009-07-31 19:44 UTC (permalink / raw)
To: Dean Nelson
Cc: netdev@vger.kernel.org, Waskiewicz Jr, Peter P, Brandeburg, Jesse,
Kirsher, Jeffrey T
In-Reply-To: <20090731191340.5470.79342.send-patch@aqua>
On Fri, 31 Jul 2009, Dean Nelson wrote:
> PCI drivers that implement the struct pci_error_handlers' error_detected
> callback should return PCI_ERS_RESULT_DISCONNECT if the state passed in is
> pci_channel_io_perm_failure. This patch fixes the issue for ixgb.
>
> Signed-off-by: Dean Nelson <dnelson@redhat.com>
>
> ---
>
> This patch has not been tested, since I don't have the hardware to test it.
> It is based on a few recent patches. See the following commits:
>
> http://git.kernel.org/linus/c93b5a76d58656158d195a7df507ebc660010969
> http://git.kernel.org/linus/eab633021c26025b34f36f79f0311d3d99f40ceb
> http://git.kernel.org/linus/ef681ce1e8b3e63317cd724c200b2fd39286c005
> http://git.kernel.org/linus/59ed6eecff4aa00c5c5d18ffd180acac108d596e
> http://git.kernel.org/linus/3044b8d1ff8c05237652a692fb572a34e4d70146
>
> drivers/net/ixgb/ixgb_main.c | 5 +++++
> 1 files changed, 5 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
> index eb917f1..fad08ce 100644
> --- a/drivers/net/ixgb/ixgb_main.c
> +++ b/drivers/net/ixgb/ixgb_main.c
> @@ -2227,6 +2227,11 @@ static pci_ers_result_t ixgb_io_error_detected(struct pci_dev *pdev,
> struct net_device *netdev = pci_get_drvdata(pdev);
> struct ixgb_adapter *adapter = netdev_priv(netdev);
>
> + netif_device_detach(netdev);
> +
> + if (state == pci_channel_io_perm_failure)
> + return PCI_ERS_RESULT_DISCONNECT;
> +
> if (netif_running(netdev))
> ixgb_down(adapter, true);
Seems reasonable, especially since the same logic works fine on our other
drivers. The hardware for this driver is somewhat difficult to get our
hands on, but we'll definately give this a spot test once we can locate
one of these NICs.
Cheers,
-PJ Waskiewicz
^ permalink raw reply
* Re: tty_register_device NULL pointer dereference in 2.6.31-rc4
From: Dave Young @ 2009-08-01 3:17 UTC (permalink / raw)
To: Oliver Hartkopp
Cc: Alan Cox, Marcel Holtmann, Linux Netdev List,
linux-bluetooth-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <4A72D373.7080802-fJ+pQTUTwRTk1uMJSBkQmQ@public.gmane.org>
On Fri, Jul 31, 2009 at 01:20:19PM +0200, Oliver Hartkopp wrote:
> Dave Young wrote:
> > On Fri, Jul 31, 2009 at 5:39 PM, Dave Young<hidave.darkstar-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> >> On Thu, Jul 30, 2009 at 12:05:55PM +0200, Oliver Hartkopp wrote:
> >>> Dave Young wrote:
> >>>> On Wed, Jul 29, 2009 at 10:00 PM, Oliver Hartkopp<oliver-fJ+pQTUTwRTk1uMJSBkQmQ@public.gmane.org> wrote:
> >>>>> Hi Dave,
> >>>>>
> >>>>> i got it again - even with your patch (that's why it's 2.6.31-rc4-dirty in the
> >>>>> attached screenshot).
> >>>> Weird, the oops occurs between sock init and tty init routines. Could
> >>>> you tell your bluez version and your configuration?
> >>>>
> >>> No problem:
> >> Thanks.
> >>
> >> It's still reasonable, after rfcomm sock layer initialized, userspace do sock ioctl callback but tty layer was not initilized yet at this time.
> >>
> >> Could you confirm it by applying following debug patch on top of my previous patch? if you get more oops with it then above reason will be right.
> >>
> >> --- linux-2.6.orig/net/bluetooth/rfcomm/core.c 2009-07-31 17:14:07.000000000 +0800
> >> +++ linux-2.6/net/bluetooth/rfcomm/core.c 2009-07-31 17:30:39.000000000 +0800
> >> @@ -36,6 +36,7 @@
> >> #include <linux/net.h>
> >> #include <linux/mutex.h>
> >> #include <linux/kthread.h>
> >> +#include <linux/nmi.h>
> >>
> >> #include <net/sock.h>
> >> #include <asm/uaccess.h>
> >> @@ -2080,7 +2081,7 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, r
> >> /* ---- Initialization ---- */
> >> static int __init rfcomm_init(void)
> >> {
> >> - int ret;
> >> + int ret, i;
> >>
> >> l2cap_load();
> >>
> >> @@ -2088,6 +2089,12 @@ static int __init rfcomm_init(void)
> >> if (ret)
> >> goto out_sock;
> >>
> >> + /* delay 5 seconds to trigger the tty bug */
> >> + for (i = 0; i < 50; i++) {
> >> + touch_nmi_watchdog();
> >> + mdelay(100);
> >
> > Hi, for this case, msleep is better, you can just replace the above
> > two lines with msleep(100)
> >
>
> Hi Dave,
>
> applied this patch and replaced mdelay(100) with msleep(100).
>
> I got two crashes and three proper boots.
>
> The crashes look like the formerly posted screenshots.
> When it boots properly i can see the delay in the boot process.
>
> Does this help?
Yes, I think so.
Please unapply the before two patch, try the following v2 patch instead.
Changes from v1: fixes 'goto' path again, make tty init before sock init.
Thanks.
---
rfcomm tty may be used before rfcomm_tty_driver initilized,
The problem is that now socket layer init before tty layer, if userspace
program do socket callback right here then oops will happen.
reporting in:
http://marc.info/?l=linux-bluetooth&m=124404919324542&w=2
make 3 changes:
1. remove #ifdef in rfcomm/core.c,
make it blank function when rfcomm tty not selected in rfcomm.h
2. tune the rfcomm_init error patch to ensure
tty driver initilized before rfcomm socket usage.
3. remove __exit for rfcomm_cleanup_sockets
because above change need call it in a __init function.
CC: Alan Cox <alan-qBU/x9rampVanCEyBjwyrvXRex20P6io@public.gmane.org>
Reported-by: Oliver Hartkopp <oliver-fJ+pQTUTwRTk1uMJSBkQmQ@public.gmane.org>
Signed-off-by: Dave Young <hidave.darkstar-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
--
include/net/bluetooth/rfcomm.h | 13 ++++++++++++-
net/bluetooth/rfcomm/core.c | 29 ++++++++++++++++++++---------
net/bluetooth/rfcomm/sock.c | 2 +-
3 files changed, 33 insertions(+), 11 deletions(-)
--- linux-2.6.orig/include/net/bluetooth/rfcomm.h 2009-08-01 10:53:18.000000000 +0800
+++ linux-2.6/include/net/bluetooth/rfcomm.h 2009-08-01 10:55:29.000000000 +0800
@@ -355,7 +355,18 @@ struct rfcomm_dev_list_req {
};
int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+
+#ifdef CONFIG_BT_RFCOMM_TTY
int rfcomm_init_ttys(void);
void rfcomm_cleanup_ttys(void);
-
+#else
+static inline int rfcomm_init_ttys(void)
+{
+ return 0;
+}
+static inline int rfcomm_cleanup_ttys(void)
+{
+ return 0;
+}
+#endif
#endif /* __RFCOMM_H */
--- linux-2.6.orig/net/bluetooth/rfcomm/core.c 2009-08-01 10:53:18.000000000 +0800
+++ linux-2.6/net/bluetooth/rfcomm/core.c 2009-08-01 11:03:24.000000000 +0800
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, r
/* ---- Initialization ---- */
static int __init rfcomm_init(void)
{
+ int ret;
+
l2cap_load();
hci_register_cb(&rfcomm_cb);
rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
if (IS_ERR(rfcomm_thread)) {
- hci_unregister_cb(&rfcomm_cb);
- return PTR_ERR(rfcomm_thread);
+ ret = PTR_ERR(rfcomm_thread);
+ goto out_thread;
}
if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
BT_ERR("Failed to create RFCOMM info file");
- rfcomm_init_sockets();
-
-#ifdef CONFIG_BT_RFCOMM_TTY
- rfcomm_init_ttys();
-#endif
+ ret = rfcomm_init_ttys();
+ if (ret)
+ goto out_tty;
+
+ ret = rfcomm_init_sockets();
+ if (ret)
+ goto out_sock;
BT_INFO("RFCOMM ver %s", VERSION);
return 0;
+
+out_sock:
+ rfcomm_cleanup_ttys();
+out_tty:
+ kthread_stop(rfcomm_thread);
+out_thread:
+ hci_unregister_cb(&rfcomm_cb);
+
+ return ret;
}
static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
kthread_stop(rfcomm_thread);
-#ifdef CONFIG_BT_RFCOMM_TTY
rfcomm_cleanup_ttys();
-#endif
rfcomm_cleanup_sockets();
}
--- linux-2.6.orig/net/bluetooth/rfcomm/sock.c 2009-08-01 10:53:18.000000000 +0800
+++ linux-2.6/net/bluetooth/rfcomm/sock.c 2009-08-01 10:55:29.000000000 +0800
@@ -1132,7 +1132,7 @@ error:
return err;
}
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
{
class_remove_file(bt_class, &class_attr_rfcomm);
^ permalink raw reply
* [PATCH 6/10] drivers/net/wireless/iwlwifi: introduce missing kfree
From: Julia Lawall @ 2009-08-01 8:54 UTC (permalink / raw)
To: yi.zhu-ral2JQCrhuEAvxtiuMwx3w,
reinette.chatre-ral2JQCrhuEAvxtiuMwx3w,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
ipw3945-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA, kernel-janitors
From: Julia Lawall <julia-dAYI7NvHqcQ@public.gmane.org>
Error handling code following a kzalloc should free the allocated data.
The semantic match that finds the problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@
x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
when != if (...) { <+...x...+> }
(
x->f1 = E
|
(x->f1 == NULL || ...)
|
f(...,x->f1,...)
)
...>
(
return \(0\|<+...x...+>\|ptr\);
|
return@p2 ...;
)
@script:python@
p1 << r.p1;
p2 << r.p2;
@@
print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: Julia Lawall <julia-dAYI7NvHqcQ@public.gmane.org>
---
drivers/net/wireless/iwlwifi/iwl-debugfs.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 7707a26..c2106d0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -320,6 +320,7 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
ptr = priv->eeprom;
if (!ptr) {
IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
+ kfree(buf);
return -ENOMEM;
}
pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* [PATCH 10/10] drivers/net/wireless: introduce missing kfree
From: Julia Lawall @ 2009-08-01 8:55 UTC (permalink / raw)
To: linville, linux-wireless, netdev, linux-kernel, kernel-janitors
From: Julia Lawall <julia@diku.dk>
Error handling code following a kzalloc should free the allocated data.
The semantic match that finds the problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@
x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
when != if (...) { <+...x...+> }
(
x->f1 = E
|
(x->f1 == NULL || ...)
|
f(...,x->f1,...)
)
...>
(
return \(0\|<+...x...+>\|ptr\);
|
return@p2 ...;
)
@script:python@
p1 << r.p1;
p2 << r.p2;
@@
print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
---
drivers/net/wireless/iwmc3200wifi/commands.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 0d66370..2bf9ef9 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -233,6 +233,7 @@ int iwm_store_rxiq_calib_result(struct iwm_priv *iwm)
eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
if (IS_ERR(eeprom_rxiq)) {
IWM_ERR(iwm, "Couldn't access EEPROM RX IQ entry\n");
+ kfree(rxiq);
return PTR_ERR(eeprom_rxiq);
}
^ permalink raw reply related
* Re: tty_register_device NULL pointer dereference in 2.6.31-rc4
From: Oliver Hartkopp @ 2009-08-01 9:15 UTC (permalink / raw)
To: Dave Young; +Cc: Alan Cox, Marcel Holtmann, Linux Netdev List, linux-bluetooth
In-Reply-To: <20090801031705.GA2817@darkstar>
Dave Young wrote:
> On Fri, Jul 31, 2009 at 01:20:19PM +0200, Oliver Hartkopp wrote:
>> applied this patch and replaced mdelay(100) with msleep(100).
>>
>> I got two crashes and three proper boots.
>>
>> The crashes look like the formerly posted screenshots.
>> When it boots properly i can see the delay in the boot process.
>>
>> Does this help?
>
> Yes, I think so.
>
> Please unapply the before two patch, try the following v2 patch instead.
> Changes from v1: fixes 'goto' path again, make tty init before sock init.
Hi Dave,
i did a 'git reset --hard' to get back to vanilla 2.6.31-rc4 .
Applied the v2 patch and booted five times without any problems.
I'll keep you informed if anything changes ;-)
Thanks,
Oliver
> ---
>
> rfcomm tty may be used before rfcomm_tty_driver initilized,
> The problem is that now socket layer init before tty layer, if userspace
> program do socket callback right here then oops will happen.
>
> reporting in:
> http://marc.info/?l=linux-bluetooth&m=124404919324542&w=2
>
> make 3 changes:
> 1. remove #ifdef in rfcomm/core.c,
> make it blank function when rfcomm tty not selected in rfcomm.h
>
> 2. tune the rfcomm_init error patch to ensure
> tty driver initilized before rfcomm socket usage.
>
> 3. remove __exit for rfcomm_cleanup_sockets
> because above change need call it in a __init function.
>
>
> CC: Alan Cox <alan@lxorguk.ukuu.org.uk>
> Reported-by: Oliver Hartkopp <oliver@hartkopp.net>
> Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
> --
> include/net/bluetooth/rfcomm.h | 13 ++++++++++++-
> net/bluetooth/rfcomm/core.c | 29 ++++++++++++++++++++---------
> net/bluetooth/rfcomm/sock.c | 2 +-
> 3 files changed, 33 insertions(+), 11 deletions(-)
>
> --- linux-2.6.orig/include/net/bluetooth/rfcomm.h 2009-08-01 10:53:18.000000000 +0800
> +++ linux-2.6/include/net/bluetooth/rfcomm.h 2009-08-01 10:55:29.000000000 +0800
> @@ -355,7 +355,18 @@ struct rfcomm_dev_list_req {
> };
>
> int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
> +
> +#ifdef CONFIG_BT_RFCOMM_TTY
> int rfcomm_init_ttys(void);
> void rfcomm_cleanup_ttys(void);
> -
> +#else
> +static inline int rfcomm_init_ttys(void)
> +{
> + return 0;
> +}
> +static inline int rfcomm_cleanup_ttys(void)
> +{
> + return 0;
> +}
> +#endif
> #endif /* __RFCOMM_H */
> --- linux-2.6.orig/net/bluetooth/rfcomm/core.c 2009-08-01 10:53:18.000000000 +0800
> +++ linux-2.6/net/bluetooth/rfcomm/core.c 2009-08-01 11:03:24.000000000 +0800
> @@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, r
> /* ---- Initialization ---- */
> static int __init rfcomm_init(void)
> {
> + int ret;
> +
> l2cap_load();
>
> hci_register_cb(&rfcomm_cb);
>
> rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
> if (IS_ERR(rfcomm_thread)) {
> - hci_unregister_cb(&rfcomm_cb);
> - return PTR_ERR(rfcomm_thread);
> + ret = PTR_ERR(rfcomm_thread);
> + goto out_thread;
> }
>
> if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
> BT_ERR("Failed to create RFCOMM info file");
>
> - rfcomm_init_sockets();
> -
> -#ifdef CONFIG_BT_RFCOMM_TTY
> - rfcomm_init_ttys();
> -#endif
> + ret = rfcomm_init_ttys();
> + if (ret)
> + goto out_tty;
> +
> + ret = rfcomm_init_sockets();
> + if (ret)
> + goto out_sock;
>
> BT_INFO("RFCOMM ver %s", VERSION);
>
> return 0;
> +
> +out_sock:
> + rfcomm_cleanup_ttys();
> +out_tty:
> + kthread_stop(rfcomm_thread);
> +out_thread:
> + hci_unregister_cb(&rfcomm_cb);
> +
> + return ret;
> }
>
> static void __exit rfcomm_exit(void)
> @@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
>
> kthread_stop(rfcomm_thread);
>
> -#ifdef CONFIG_BT_RFCOMM_TTY
> rfcomm_cleanup_ttys();
> -#endif
>
> rfcomm_cleanup_sockets();
> }
> --- linux-2.6.orig/net/bluetooth/rfcomm/sock.c 2009-08-01 10:53:18.000000000 +0800
> +++ linux-2.6/net/bluetooth/rfcomm/sock.c 2009-08-01 10:55:29.000000000 +0800
> @@ -1132,7 +1132,7 @@ error:
> return err;
> }
>
> -void __exit rfcomm_cleanup_sockets(void)
> +void rfcomm_cleanup_sockets(void)
> {
> class_remove_file(bt_class, &class_attr_rfcomm);
>
^ permalink raw reply
* Re: tty_register_device NULL pointer dereference in 2.6.31-rc4
From: Oliver Hartkopp @ 2009-08-01 9:21 UTC (permalink / raw)
To: Dave Young
Cc: Alan Cox, Marcel Holtmann, Linux Netdev List,
linux-bluetooth-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <20090801031705.GA2817@darkstar>
> --- linux-2.6.orig/include/net/bluetooth/rfcomm.h 2009-08-01 10:53:18.000000000 +0800
> +++ linux-2.6/include/net/bluetooth/rfcomm.h 2009-08-01 10:55:29.000000000 +0800
> @@ -355,7 +355,18 @@ struct rfcomm_dev_list_req {
> };
>
> int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
> +
> +#ifdef CONFIG_BT_RFCOMM_TTY
> int rfcomm_init_ttys(void);
> void rfcomm_cleanup_ttys(void);
> -
> +#else
> +static inline int rfcomm_init_ttys(void)
> +{
> + return 0;
> +}
> +static inline int rfcomm_cleanup_ttys(void)
> +{
> + return 0;
> +}
> +#endif
Just a minor thing:
Does rfcomm_cleanup_ttys() return 'int' or is it 'void' ?
Regards,
Oliver
^ permalink raw reply
* Re: tty_register_device NULL pointer dereference in 2.6.31-rc4
From: Dave Young @ 2009-08-01 9:32 UTC (permalink / raw)
To: Oliver Hartkopp
Cc: Alan Cox, Marcel Holtmann, Linux Netdev List, linux-bluetooth
In-Reply-To: <4A740918.1040504@hartkopp.net>
On Sat, Aug 01, 2009 at 11:21:28AM +0200, Oliver Hartkopp wrote:
>
> > --- linux-2.6.orig/include/net/bluetooth/rfcomm.h 2009-08-01 10:53:18.000000000 +0800
> > +++ linux-2.6/include/net/bluetooth/rfcomm.h 2009-08-01 10:55:29.000000000 +0800
> > @@ -355,7 +355,18 @@ struct rfcomm_dev_list_req {
> > };
> >
> > int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
> > +
> > +#ifdef CONFIG_BT_RFCOMM_TTY
> > int rfcomm_init_ttys(void);
> > void rfcomm_cleanup_ttys(void);
> > -
> > +#else
> > +static inline int rfcomm_init_ttys(void)
> > +{
> > + return 0;
> > +}
> > +static inline int rfcomm_cleanup_ttys(void)
> > +{
> > + return 0;
> > +}
> > +#endif
>
> Just a minor thing:
>
> Does rfcomm_cleanup_ttys() return 'int' or is it 'void' ?
Yes it should be void. Thanks for pointing out, here update the patch:
---
rfcomm tty may be used before rfcomm_tty_driver initilized,
The problem is that now socket layer init before tty layer, if userspace
program do socket callback right here then oops will happen.
reporting in:
http://marc.info/?l=linux-bluetooth&m=124404919324542&w=2
make 3 changes:
1. remove #ifdef in rfcomm/core.c,
make it blank function when rfcomm tty not selected in rfcomm.h
2. tune the rfcomm_init error patch to ensure
tty driver initilized before rfcomm socket usage.
3. remove __exit for rfcomm_cleanup_sockets
because above change need call it in a __init function.
CC: Alan Cox <alan@lxorguk.ukuu.org.uk>
Reported-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
--
include/net/bluetooth/rfcomm.h | 12 +++++++++++-
net/bluetooth/rfcomm/core.c | 29 ++++++++++++++++++++---------
net/bluetooth/rfcomm/sock.c | 2 +-
3 files changed, 32 insertions(+), 11 deletions(-)
--- linux-2.6.orig/include/net/bluetooth/rfcomm.h 2009-08-01 13:56:53.000000000 +0800
+++ linux-2.6/include/net/bluetooth/rfcomm.h 2009-08-01 17:24:59.000000000 +0800
@@ -355,7 +355,17 @@ struct rfcomm_dev_list_req {
};
int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+
+#ifdef CONFIG_BT_RFCOMM_TTY
int rfcomm_init_ttys(void);
void rfcomm_cleanup_ttys(void);
-
+#else
+static inline int rfcomm_init_ttys(void)
+{
+ return 0;
+}
+static inline void rfcomm_cleanup_ttys(void)
+{
+}
+#endif
#endif /* __RFCOMM_H */
--- linux-2.6.orig/net/bluetooth/rfcomm/core.c 2009-08-01 13:56:53.000000000 +0800
+++ linux-2.6/net/bluetooth/rfcomm/core.c 2009-08-01 13:57:18.000000000 +0800
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, r
/* ---- Initialization ---- */
static int __init rfcomm_init(void)
{
+ int ret;
+
l2cap_load();
hci_register_cb(&rfcomm_cb);
rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
if (IS_ERR(rfcomm_thread)) {
- hci_unregister_cb(&rfcomm_cb);
- return PTR_ERR(rfcomm_thread);
+ ret = PTR_ERR(rfcomm_thread);
+ goto out_thread;
}
if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
BT_ERR("Failed to create RFCOMM info file");
- rfcomm_init_sockets();
-
-#ifdef CONFIG_BT_RFCOMM_TTY
- rfcomm_init_ttys();
-#endif
+ ret = rfcomm_init_ttys();
+ if (ret)
+ goto out_tty;
+
+ ret = rfcomm_init_sockets();
+ if (ret)
+ goto out_sock;
BT_INFO("RFCOMM ver %s", VERSION);
return 0;
+
+out_sock:
+ rfcomm_cleanup_ttys();
+out_tty:
+ kthread_stop(rfcomm_thread);
+out_thread:
+ hci_unregister_cb(&rfcomm_cb);
+
+ return ret;
}
static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
kthread_stop(rfcomm_thread);
-#ifdef CONFIG_BT_RFCOMM_TTY
rfcomm_cleanup_ttys();
-#endif
rfcomm_cleanup_sockets();
}
--- linux-2.6.orig/net/bluetooth/rfcomm/sock.c 2009-08-01 13:56:53.000000000 +0800
+++ linux-2.6/net/bluetooth/rfcomm/sock.c 2009-08-01 13:57:18.000000000 +0800
@@ -1132,7 +1132,7 @@ error:
return err;
}
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
{
class_remove_file(bt_class, &class_attr_rfcomm);
^ permalink raw reply
* [PATCH 2.6.31-rc4] gigaset: really fix chars_in_buffer
From: Tilman Schmidt @ 2009-08-01 12:18 UTC (permalink / raw)
To: davem, linux-kernel, netdev; +Cc: Alan Cox, Hansjoerg Lipp
This patch corrects the problem noted but left unfixed by commit
23198fda7182969b619613a555f8645fdc3dc334 "tty: fix chars_in_buffers".
The tty_operation chars_in_buffer() should return zero, not a
negative value, in the error case.
Impact: error handling bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
---
I only just noticed the "tty: fix chars_in_buffers" patch going in.
Please merge this follow-up fix for 2.6.31, too. Thanks.
drivers/isdn/gigaset/interface.c | 18 +++++++-----------
1 files changed, 7 insertions(+), 11 deletions(-)
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 8b62df8..dfeec68 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -408,33 +408,29 @@ static int if_write_room(struct tty_struct *tty)
return retval;
}
-/* FIXME: This function does not have error returns */
-
static int if_chars_in_buffer(struct tty_struct *tty)
{
struct cardstate *cs;
- int retval = -ENODEV;
+ int retval = 0;
cs = (struct cardstate *) tty->driver_data;
if (!cs) {
pr_err("%s: no cardstate\n", __func__);
- return -ENODEV;
+ return 0;
}
gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
if (mutex_lock_interruptible(&cs->mutex))
- return -ERESTARTSYS; // FIXME -EINTR?
+ return 0;
- if (!cs->connected) {
+ if (!cs->connected)
gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
- } else if (!cs->open_count)
+ else if (!cs->open_count)
dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
+ else if (cs->mstate != MS_LOCKED)
dev_warn(cs->dev, "can't write to unlocked device\n");
- retval = -EBUSY;
- } else
+ else
retval = cs->ops->chars_in_buffer(cs);
mutex_unlock(&cs->mutex);
--
1.6.2.1.214.ge986c
^ permalink raw reply related
* Re: [PATCH 2.6.31-rc4] gigaset: really fix chars_in_buffer
From: Alan Cox @ 2009-08-01 16:11 UTC (permalink / raw)
To: Tilman Schmidt; +Cc: davem, linux-kernel, netdev, Alan Cox, Hansjoerg Lipp
In-Reply-To: <20090801-patch-01.tilman@imap.cc>
On Sat, 1 Aug 2009 14:18:51 +0200 (CEST)
Tilman Schmidt <tilman@imap.cc> wrote:
> This patch corrects the problem noted but left unfixed by commit
> 23198fda7182969b619613a555f8645fdc3dc334 "tty: fix chars_in_buffers".
> The tty_operation chars_in_buffer() should return zero, not a
> negative value, in the error case.
Is that correct. If you take a signal so the mutex_lock_interruptible
takes the error path we'll exit any waits for characters to be flushed
from buffers and lose the bytes in some cases ? Thats why I didn't
convert it - I didn't understand why it was using _interruptible at all ?
Alan
^ permalink raw reply
* [PATCH 4/5] drivers/net/wireless: Use DIV_ROUND_CLOSEST
From: Julia Lawall @ 2009-08-01 19:50 UTC (permalink / raw)
To: linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA
From: Julia Lawall <julia-dAYI7NvHqcQ@public.gmane.org>
The kernel.h macro DIV_ROUND_CLOSEST performs the computation (x + d/2)/d
but is perhaps more readable.
The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@haskernel@
@@
#include <linux/kernel.h>
@depends on haskernel@
expression x,__divisor;
@@
- (((x) + ((__divisor) / 2)) / (__divisor))
+ DIV_ROUND_CLOSEST(x,__divisor)
// </smpl>
Signed-off-by: Julia Lawall <julia-dAYI7NvHqcQ@public.gmane.org>
---
drivers/net/wireless/strip.c | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index 73300c2..8eabb56 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -1550,9 +1550,12 @@ static int strip_xmit(struct sk_buff *skb, struct net_device *dev)
if (time_after(jiffies, strip_info->pps_timer + HZ)) {
unsigned long t = jiffies - strip_info->pps_timer;
- unsigned long rx_pps_count = (strip_info->rx_pps_count * HZ * 8 + t / 2) / t;
- unsigned long tx_pps_count = (strip_info->tx_pps_count * HZ * 8 + t / 2) / t;
- unsigned long sx_pps_count = (strip_info->sx_pps_count * HZ * 8 + t / 2) / t;
+ unsigned long rx_pps_count =
+ DIV_ROUND_CLOSEST(strip_info->rx_pps_count*HZ*8, t);
+ unsigned long tx_pps_count =
+ DIV_ROUND_CLOSEST(strip_info->tx_pps_count*HZ*8, t);
+ unsigned long sx_pps_count =
+ DIV_ROUND_CLOSEST(strip_info->sx_pps_count*HZ*8, t);
strip_info->pps_timer = jiffies;
strip_info->rx_pps_count = 0;
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* [PATCH 5/5] drivers/net: Use DIV_ROUND_CLOSEST
From: Julia Lawall @ 2009-08-01 19:51 UTC (permalink / raw)
To: netdev, linux-kernel, kernel-janitors
From: Julia Lawall <julia@diku.dk>
The kernel.h macro DIV_ROUND_CLOSEST performs the computation (x + d/2)/d
but is perhaps more readable.
The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@haskernel@
@@
#include <linux/kernel.h>
@depends on haskernel@
expression x,__divisor;
@@
- (((x) + ((__divisor) / 2)) / (__divisor))
+ DIV_ROUND_CLOSEST(x,__divisor)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
---
drivers/net/b44.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 1f7f015..07c92f3 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1297,7 +1297,8 @@ static void b44_chip_reset(struct b44 *bp, int reset_kind)
switch (sdev->bus->bustype) {
case SSB_BUSTYPE_SSB:
bw32(bp, B44_MDIO_CTRL, (MDIO_CTRL_PREAMBLE |
- (((ssb_clockspeed(sdev->bus) + (B44_MDC_RATIO / 2)) / B44_MDC_RATIO)
+ (DIV_ROUND_CLOSEST(ssb_clockspeed(sdev->bus),
+ B44_MDC_RATIO)
& MDIO_CTRL_MAXF_MASK)));
break;
case SSB_BUSTYPE_PCI:
^ permalink raw reply related
* (unknown)
From: Marc Fiuczynski @ 2009-08-01 21:21 UTC (permalink / raw)
To: netdev@vger.kernel.org
^ permalink raw reply
* Re: [PATCH 2.6.31-rc4] gigaset: really fix chars_in_buffer
From: Tilman Schmidt @ 2009-08-01 23:37 UTC (permalink / raw)
To: Alan Cox; +Cc: davem, linux-kernel, netdev, Alan Cox, Hansjoerg Lipp
In-Reply-To: <20090801171141.7a463347@lxorguk.ukuu.org.uk>
[-- Attachment #1: Type: text/plain, Size: 1452 bytes --]
Hi Alan,
thanks a lot for getting in contact with me, and for your
explanation of the rationale behind your patch.
On Sat, 1 Aug 2009 17:11:41 +0100, Alan Cox wrote:
> Is that correct. If you take a signal so the mutex_lock_interruptible
> takes the error path we'll exit any waits for characters to be flushed
> from buffers and lose the bytes in some cases ?
You are right. I'll have to change it to use non-interruptible
mutex_lock. I'll prepare a new patch.
> Thats why I didn't
> convert it - I didn't understand why it was using _interruptible at all ?
No specific reason. just the general rule to prefer sleeping
interuptibly whenever possible, because unkillable processes are
so annoying. Seeing that chars_in_buffer was declared as returning
int, I assumed (wrongly as it now turns out) that it would be
allowed to return the customary negative values for errors, so
that it could use the _interruptible variant. When I saw your
patch I read into it that zero would be the appropriate return
value for all error cases, including a signal while waiting for
the mutex. I guess there was a bit of wishful thinking in that.
Well, thanks again for your help. I'll follow up with a revised
patch.
Regards,
Tilman
--
Tilman Schmidt E-Mail: tilman@imap.cc
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 254 bytes --]
^ permalink raw reply
* [PATCH v2 2.6.31-rc4] gigaset: really fix chars_in_buffer
From: Tilman Schmidt @ 2009-08-02 0:36 UTC (permalink / raw)
To: davem, linux-kernel, netdev; +Cc: Alan Cox, Hansjoerg Lipp
In-Reply-To: <20090801-patch-01.tilman@imap.cc>
The tty_operation chars_in_buffer() is not allowed to return a
negative value to signal an error. Corrects the problem flagged
by commit 23198fda7182969b619613a555f8645fdc3dc334,
"tty: fix chars_in_buffers".
Impact: error handling bugfix
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
---
drivers/isdn/gigaset/interface.c | 19 +++++++------------
1 files changed, 7 insertions(+), 12 deletions(-)
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 8ff7e35..f33ac27 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -408,33 +408,28 @@ static int if_write_room(struct tty_struct *tty)
return retval;
}
-/* FIXME: This function does not have error returns */
-
static int if_chars_in_buffer(struct tty_struct *tty)
{
struct cardstate *cs;
- int retval = -ENODEV;
+ int retval = 0;
cs = (struct cardstate *) tty->driver_data;
if (!cs) {
pr_err("%s: no cardstate\n", __func__);
- return -ENODEV;
+ return 0;
}
gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
- if (mutex_lock_interruptible(&cs->mutex))
- return -ERESTARTSYS; // FIXME -EINTR?
+ mutex_lock(&cs->mutex);
- if (!cs->connected) {
+ if (!cs->connected)
gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
- } else if (!cs->open_count)
+ else if (!cs->open_count)
dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
+ else if (cs->mstate != MS_LOCKED)
dev_warn(cs->dev, "can't write to unlocked device\n");
- retval = -EBUSY;
- } else
+ else
retval = cs->ops->chars_in_buffer(cs);
mutex_unlock(&cs->mutex);
--
1.6.2.1.214.ge986c
^ permalink raw reply related
* Re: [PATCH 1/5] be2net: get rid of be_ctrl_info struct/abstraction
From: David Miller @ 2009-08-02 6:07 UTC (permalink / raw)
To: sathyap; +Cc: netdev
In-Reply-To: <20090728084408.GA4409@serverengines.com>
From: Sathya Perla <sathyap@serverengines.com>
Date: Tue, 28 Jul 2009 14:14:08 +0530
> Currently only the be_ctrl_info struct ptr (instead of adapter) is
> passed to all the routines in be_cmds.c. Instead pass be_adapter
> ptr to allow access to all its fields. Merge the contents of struct be_ctrl_info
> into be_adapter. The resulting code is simpler.
>
> Signed-off-by: Sathya Perla <sathyap@serverengines.com>
Applied.
^ permalink raw reply
* Re: [net-next-2.6 PATCH 2/5] be2net: remove pci_func field from be_adapter struct
From: David Miller @ 2009-08-02 6:07 UTC (permalink / raw)
To: sathyap; +Cc: netdev
In-Reply-To: <20090728085223.GA4977@serverengines.com>
From: Sathya Perla <sathyap@serverengines.com>
Date: Tue, 28 Jul 2009 14:22:23 +0530
> pci function is available as PCI_FUNC(pdev->devfn); no need for a
> separate field.
>
> Signed-off-by: Sathya Perla <sathyap@serverengines.com>
Applied.
^ permalink raw reply
* Re: [net-next-2.6 PATCH 3/5] be2net: replace some printks with dev_err()/dev_warn()
From: David Miller @ 2009-08-02 6:07 UTC (permalink / raw)
To: sathyap; +Cc: netdev
In-Reply-To: <20090728085256.GA4993@serverengines.com>
From: Sathya Perla <sathyap@serverengines.com>
Date: Tue, 28 Jul 2009 14:22:56 +0530
> And get rid of some unnecessary printks.
>
> Signed-off-by: Sathya Perla <sathyap@serverengines.com>
Applied.
^ permalink raw reply
* Re: [net-next-2.6 PATCH 4/5] be2net: some name changes for consistency
From: David Miller @ 2009-08-02 6:08 UTC (permalink / raw)
To: sathyap; +Cc: netdev
In-Reply-To: <20090728085310.GA5009@serverengines.com>
From: Sathya Perla <sathyap@serverengines.com>
Date: Tue, 28 Jul 2009 14:23:10 +0530
> be_mbox_db_ring() has been changed to be_mbox_notify() (to be consistent with
> be_mcc_notify()) and struct be_mcc_cq_entry changed to be_mcc_compl
> to be consistent with rx/tx_compl.
>
> Signed-off-by: Sathya Perla <sathyap@serverengines.com>
Applied.
^ permalink raw reply
* Re: [net-next-2.6 PATCH 5/5] be2net: delete unnecessary code from be_cmd_POST()
From: David Miller @ 2009-08-02 6:08 UTC (permalink / raw)
To: sathyap; +Cc: netdev
In-Reply-To: <20090728085330.GA5025@serverengines.com>
From: Sathya Perla <sathyap@serverengines.com>
Date: Tue, 28 Jul 2009 14:23:30 +0530
> When the driver loads the POST stage of the card is expected to be
> POST_STAGE_ARMFW_RDY.
>
> Signed-off-by: Sathya Perla <sathyap@serverengines.com>
Applied.
^ permalink raw reply
* Re: [net-next-2.6 PATCH 0/9] return PCI_ERS_RESULT_DISCONNECT on permanent failure
From: David Miller @ 2009-08-02 6:13 UTC (permalink / raw)
To: dnelson; +Cc: netdev
In-Reply-To: <20090731191254.5470.99642.send-patch@aqua>
From: Dean Nelson <dnelson@redhat.com>
Date: Fri, 31 Jul 2009 15:12:55 -0400
> PCI drivers that implement the struct pci_error_handlers' error_detected
> callback should return PCI_ERS_RESULT_DISCONNECT if the state passed in is
> pci_channel_io_perm_failure.
...
> This patchset is an attempt to address the remaining net drivers of this type.
> None of the patches in this patchset have been tested, since I don't have the
> hardware to test any of them. I'm simply making these patches available for
> whomever is interested and able to test them, to do so. Perhaps the individual
> patches can be committed as they get tested, reviewed and ACK'd.
I think these are safe to apply, they look so straightforward
to me. I've thus added them all to net-next-2.6, thanks!
^ permalink raw reply
* [PATCH] s6gmac: Read buffer overflow
From: Roel Kluin @ 2009-08-02 6:20 UTC (permalink / raw)
To: davem, netdev, Andrew Morton
Check whether index is within bounds before testing the element.
In the last iteration i is PHY_MAX_ADDR. the condition
`!(p = pd->mii.bus->phy_map[PHY_MAX_ADDR])' is undefined and may
evaluate to false, which leads to a dereference of this invalid
phy_map in the phy_connect() below.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/net/s6gmac.c b/drivers/net/s6gmac.c
index 5345e47..4525cbe 100644
--- a/drivers/net/s6gmac.c
+++ b/drivers/net/s6gmac.c
@@ -793,7 +793,7 @@ static inline int s6gmac_phy_start(struct net_device *dev)
struct s6gmac *pd = netdev_priv(dev);
int i = 0;
struct phy_device *p = NULL;
- while ((!(p = pd->mii.bus->phy_map[i])) && (i < PHY_MAX_ADDR))
+ while ((i < PHY_MAX_ADDR) && (!(p = pd->mii.bus->phy_map[i])))
i++;
p = phy_connect(dev, dev_name(&p->dev), &s6gmac_adjust_link, 0,
PHY_INTERFACE_MODE_RGMII);
^ permalink raw reply related
* [PATCH] tulip: Read buffer overflow
From: Roel Kluin @ 2009-08-02 6:26 UTC (permalink / raw)
To: grundler, kyle, netdev, Andrew Morton
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index eb72d2e..acfdccd 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -5059,7 +5059,7 @@ mii_get_phy(struct net_device *dev)
if ((id == 0) || (id == 65535)) continue; /* Valid ID? */
for (j=0; j<limit; j++) { /* Search PHY table */
if (id != phy_info[j].id) continue; /* ID match? */
- for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+ for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
if (k < DE4X5_MAX_PHY) {
memcpy((char *)&lp->phy[k],
(char *)&phy_info[j], sizeof(struct phy_table));
@@ -5072,7 +5072,7 @@ mii_get_phy(struct net_device *dev)
break;
}
if ((j == limit) && (i < DE4X5_MAX_MII)) {
- for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+ for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
lp->phy[k].addr = i;
lp->phy[k].id = id;
lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */
@@ -5091,7 +5091,7 @@ mii_get_phy(struct net_device *dev)
purgatory:
lp->active = 0;
if (lp->phy[0].id) { /* Reset the PHY devices */
- for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++) { /*For each PHY*/
+ for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++) { /*For each PHY*/
mii_wr(MII_CR_RST, MII_CR, lp->phy[k].addr, DE4X5_MII);
while (mii_rd(MII_CR, lp->phy[k].addr, DE4X5_MII) & MII_CR_RST);
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox