tpacket_snd() can change and kfree an skb after dev_queue_xmit(),
which is illegal.

With debugging by: Stephen Hemminger <shemminger@vyatta.com>
Reported-by: NMichael Breuer <mbreuer@majjas.com>
With help from: David S. Miller <davem@davemloft.net>
Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
Tested-by: Michael Breuer<mbreuer@majjas.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

pci_dma_mapping_error should be used to test return value of
pci_map_single or pci_map_page.
Signed-off-by: NDenis Kirjanov <kirjanov@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.
Signed-off-by: NFlorian Westphal <fwestphal@astaro.com>
Cc: stable@kernel.org
Signed-off-by: NPatrick McHardy <kaber@trash.net>

Fix e1000e_rar_set() to flush consecutive register writes to avoid write
combining which some parts cannot handle.  Update e1000e_init_rx_addrs()
to call the fixed e1000e_rar_set() instead of duplicating code.

Also change e1000e_rar_set() to _not_ set the Address Valid bit if the MAC
address is all zeros.
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

e1000e_enable_tx_pkt_filtering() will return a non-zero value if the
driver fails to enable the manageability interface on the host for
any reason; instead it should retun zero to indicate filtering has been
disabled.  Also provide a single exit point for the function.
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Adaptive IFS which involves writing to the Adaptive IFS Throttle register
was being done for all devices supported by the driver even though it is
not supported (i.e. the register doesn't even exist) on some devices.  The
feature is supported on 8257x/82583 and ICH/PCH based devices, but not
on ESB2.
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Due to a change in pci_restore_state()[1] which clears the saved_state
flag, the driver should call pci_save_state() to set the flag once again
to avoid issues with EEH (same fix that recently was submitted for ixgbe).

[1] commmit 4b77b0a2Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

o If tx and rx resources are not available, during set mac request.
  Then this request wont be passed to firmware and it will be added to
  driver mac list and will never make it to firmware.
  So if resources are not available, don't add it to driver mac list.
Signed-off-by: NAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

o Fix pointless assignments
Signed-off-by: NAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

o While unloading driver or resetting the context, tx ring was not
  getting free.
Signed-off-by: NAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This fixes a netstamp_needed accounting issue when the listen socket
has SO_TIMESTAMP set:

    s = socket(AF_INET, SOCK_STREAM, 0);
    setsockopt(s, SOL_SOCKET, SO_TIMESTAMP, 1); -> netstamp_needed = 1
    bind(s, ...);
    listen(s, ...);
    s2 = accept(s, ...); -> netstamp_needed = 1
    close(s2); -> netstamp_needed = 0
    close(s); -> netstamp_needed = -1
Signed-off-by: NOctavian Purdila <opurdila@ixiacom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In the driver probe function the emac module clock needs to
be enabled before calling register_netdev(). As soon as the
device is registered the driver get_stats function can be invoked
by the core - the module clock must be switched on to be able to
read from stats registers. Also explicitly call matching clk_disable
for failure conditions in probe function.
Signed-off-by: NSriramakrishnan <srk@ti.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The Davicom DM9100 and DM9102 chips are used on the motherboards of
some SPARC systems (supported by the tulip driver) and also in PCI
expansion cards (supported by the dmfe driver).  There is no
difference in the PCI device ids for the two different configurations,
so these drivers both claim the device ids.  However, it is possible
to distinguish the two configurations by the presence of Open Firmware
properties for them, so we do that.
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NGrant Grundler <grundler@parisc-linux.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

tc is still throwing a warning that is could be used
uninitialized.  This fixes it, and properly formats the device ID
checks for the use of this variable.
Signed-off-by: NPeter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

As noticed by Dan Carpenter <error27@gmail.com>, update_nl_seq()
currently contains an out of bounds read of the seq_aft_nl array
when looking for the oldest sequence number position.

Fix it to only compare valid positions.

Cc: stable@kernel.org
Signed-off-by: NPatrick McHardy <kaber@trash.net>

If NET_SKB_PAD is not a multiple of the cache line size, mv643xx_eth
allocates a couple of extra bytes at the start of each receive buffer
to make the data payload end up on a cache line boundary.

These extra bytes are skb_reserve()'d before DMA mapping, so they
should not be included in the DMA map byte count (as the mapping is
done starting at skb->data), nor should they be included in the
receive descriptor buffer size field, or the hardware can end up
DMAing beyond the end of the buffer, which can happen if someone
sends us a larger-than-MTU sized packet.

This problem was introduced in commit 7fd96ce4 ("mv643xx_eth:
rework receive skb cache alignment", May 6 2009), but hasn't appeared
to be problematic so far, probably as the main users of mv643xx_eth
all have NET_SKB_PAD == L1_CACHE_BYTES.
Signed-off-by: NSaeed Bishara <saeed@marvell.com>
Signed-off-by: NLennert Buytenhek <buytenh@marvell.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Stanse found a memory leak in atl2_get_eeprom. eeprom_buff is not
freed/assigned on all paths. Fix that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jay Cliburn <jcliburn@gmail.com>
Cc: Chris Snook <chris.snook@gmail.com>
Cc: Jie Yang <jie.yang@atheros.com>
Cc: atl1-devel@lists.sourceforge.net
Cc: "David S. Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

A failure on request_irq() is always fatal but unlike other fatal
errors it's only reported to the user if net_debug is set. Make the
diagnostic unconditional and raise the priority so that errors are
more obvious to the user.
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fixed missing newlines in calls to dev_warn & dev_err.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Don't send flow control settings to any port other than the modem port.
Older firmware ignored this request but did sent a reply. Newer firmware just
ignores it without reply and causes a 5 second timeout every time a port
(except for the modem port) is opened or if tiocm settings are changed.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Attempt to reset the usb device when we receive usb bus errors.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Don't change the state of a port if it's not open. This fixes an issue where a
port sometimes has to be opened twice before data can be received.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Some fields are always little endian and have to be converted on big endian
machines.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add product ID's for new devices.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Claw module cannot be loaded together with qeth, because "qeth" has
been errorneously used as root device name. It is changed into "claw".
Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

pcnet_cs,serial_cs:

add cis of KTI PE520 pcmcia network card,
and serial card(Sierra Wireless AC860).
Signed-off-by: NKen Kawasaki <ken_kawasaki@spring.nifty.jp>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When we have L3 tunnels with different inner/outer families
(i.e. IPV4/IPV6) which use a multicast address as the outer tunnel
destination address, multicast packets will be loopbacked back to the
sending socket even if IP*_MULTICAST_LOOP is set to disabled.

The mc_loop flag is present in the family specific part of the socket
(e.g. the IPv4 or IPv4 specific part).  setsockopt sets the inner
family mc_loop flag. When the packet is pushed through the L3 tunnel
it will eventually be processed by the outer family which if different
will check the flag in a different part of the socket then it was set.
Signed-off-by: NOctavian Purdila <opurdila@ixiacom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

current the Rx/Tx FIFO size settings cause problem
when four UEC ethernets work simultaneously.

eg: GETH1, UEM-J15, GETH2, UEC-J5 on 8569MDS board

 $ ifconfig eth0 10.193.20.166
 $ ifconfig eth1 10.193.20.167
 $ ifconfig eth2 10.193.20.168
 then
 $ ifconfig eth3 10.193.20.169

The fourth ethernet will cause all of interface broken,
you cann't ping successfully any more.
The patch fix this issue for MPC8569 Rev1.0 and Rev2.0
Signed-off-by: NDave Liu <daveliu@freescale.com>
Acked-by: NAnton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

As noticed by Stephen Rothwell.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The ipvs code has a nifty system for doing the size of ioctl command
copies; it defines an array with values into which it indexes the cmd
to find the right length.

Unfortunately, the ipvs code forgot to check if the cmd was in the
range that the array provides, allowing for an index outside of the
array, which then gives a "garbage" result into the length, which
then gets used for copying into a stack buffer.

Fix this by adding sanity checks on these as well as the copy size.

[ horms@verge.net.au: adjusted limit to IP_VS_SO_GET_MAX ]
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Acked-by: NJulian Anastasov <ja@ssi.bg>
Signed-off-by: NSimon Horman <horms@verge.net.au>
Signed-off-by: NPatrick McHardy <kaber@trash.net>

o Fix ethtool link test for NX3031 chip.
o Remove unused code from phy interrupt callback
Signed-off-by: NSucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: NAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

o Dump registers such as tx ring and rx ring counter, firmware state,
  niu regs, etc. which can be useful for debugging purpose.
Signed-off-by: NSucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: NAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

tx_skbuff is define as:
        struct sk_buff          *tx_skbuff[TX_RING_ENTRIES];

EVT_RING_ENTRIES is 64 and TX_RING_ENTRIES is 32.

This function is in a error path so that's why it wasn't noticed.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This always evaluates to true.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If no break occurred, cnt reaches 0 after the loop.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

With `while (--limit > 0)' i reaches 0 after the loop, so upon timeout the
error was not returned.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>