2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-27 06:34:11 +08:00
Commit Graph

146236 Commits

Author SHA1 Message Date
Johannes Berg
8fc0fee092 cfg80211: use key size constants
Instead of hardcoding the key length for validation, use the
constants Zhu Yi recently added and add one for AES_CMAC too.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:10 -04:00
Johannes Berg
362a415dce nl80211: bounce scan request back to userspace
When a scan finishes only the program that asked for it
knows what kind of scan it was; let's tell everybody else
about the scan parameters as well so they can evaluate
the result of the scan better. Also helps with debugging.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:10 -04:00
Johannes Berg
51b50fbeb5 cfg80211: validate AID of stations being added
We have some validation code in mac80211 but said code will
force an invalid AID to 0 which isn't a valid AID either;
instead require a valid AID (1-2007) to be passed in from
userspace in cfg80211 already. Also move the code before
the race comment since it can only be executed during STA
addition and thus is not racy.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:10 -04:00
Ivo van Doorn
6b347bff14 rt2x00: Remove last usage of beacon_int from ieee80211_config
This removes the last usage of beacon_int inside the iee80211_config
structure from rt2x00. The attempt is a bit hackish, and subject to
change in the future when the entire rt2x00_dev structure is
cleaned up and restructured.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:10 -04:00
Johannes Berg
e535c7566e mac80211: deprecate conf.beacon_int properly
Ivo has updated the driver to no longer use the change flag,
so we can remove that, but rt2x00 and ath5k still use the
actual value so let's mark it as deprecated too.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Dan Williams
2fa7a98fc9 libertas: fix WPA adhoc network creation
Oddly enough, the firmware's JOIN/START commands don't appear to have
any facility for setting custom IEs, thus the started adhoc network
doesn't advertise its WPA capability in the beacon.  Whee!

Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Dan Williams
822ac03a07 libertas: convert CMD_802_11_ASSOCIATE to a direct command
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Dan Williams
be0d76e48f libertas: convert CMD_802_11_AUTHENTICATE to a direct command
And fix up setting authentication suite for v9+ firmware too.

Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Dan Williams
75b6a61a47 libertas: restyle Marvell & IEEE TLV structure names
Easier to read and more conformant with kernel style.

Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Dan Williams
5fd164e96c libertas: simplify and clean up association/start/join setup
Some of the parameters for association/join/start commands aren't
used (like the FH and CF IEs for IBSS, and the FH IE for BSS), so
get rid of their unions to reduce indirection.  Also clean up
structure names for kernel style.

Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Reinette Chatre
d77b034f62 iwlwifi: fix otp access init
Polling function returns positive time if polling was needed to
read value. This is still success.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
CC: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Reinette Chatre
df29ff3794 iwlwifi: fix merge error
This hunk of code was removed in patch "iwlwifi: do not
cancel delayed work inside spin_lock_irqsave" submitted at
http://marc.info/?l=linux-wireless&m=124267503030042&w=2

This same patch in this repo does not remove this hunk.
Remove it here.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:09 -04:00
Ivo van Doorn
ce2ebc9b8d rt2x00: Add new rt2800usb USB ID's
new patch to add more usb_dev to rt2800usb.c .
IDs 'stolen' from the latest Ralink linux
driver(2009_0520_RT3070_Linux_STA_v2.1.1.0.tar.gz)

Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:08 -04:00
Sebastian Andrzej Siewior
f488b72de5 net/libertas: make SPI interface big endian aware
The comment (which I remove) says that the translation is done SPI routines.
IMHO this can't work because the SPI driver does not know whether the incomming
bytes are part of the registers/bytes which need to be flipped or part of
packet data which has to remain untouched.
While adding le helpers I also removed spu_write_u32() which has no users.

Tested-by: Andrey Yurovsky <andrey@cozybit.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:08 -04:00
John W. Linville
55aa4e0f16 ath5k: avoid leaking mutex in ath5k_config
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-03 14:05:08 -04:00
Vlad Yasevich
c6ba68a266 sctp: support non-blocking version of the new sctp_connectx() API
Prior implementation of the new sctp_connectx() call that returns
an association ID did not work correctly on non-blocking socket.
This is because we could not return both a EINPROGRESS error and
an association id.  This is a new implementation that supports this.

Originally from Ivan Skytte Jørgensen <isj-sctp@i1.dk

Signed-off-by: Ivan Skytte Jørgensen <isj-sctp@i1.dk
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:47 -04:00
Wei Yongjun
9919b455fc sctp: fix to choose alternate destination when retransmit ASCONF chunk
RFC 5061 Section 5.1 ASCONF Chunk Procedures said:

B4)  Re-transmit the ASCONF Chunk last sent and if possible choose an
     alternate destination address (please refer to [RFC4960],
     Section 6.4.1).  An endpoint MUST NOT add new parameters to this
     chunk; it MUST be the same (including its Sequence Number) as
     the last ASCONF sent.  An endpoint MAY, however, bundle an
     additional ASCONF with new ASCONF parameters with the next
     Sequence Number.  For details, see Section 5.5.

This patch fix to choose an alternate destination address when
re-transmit the ASCONF chunk, with some dup codes cleanup.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:46 -04:00
Jean-Mickael Guerin
d48e074dfd sctp: fix sack_timeout sysctl min and max types
sctp_sack_timeout is defined as int, but the sysctl's maxsize is set
to sizeof(long) and the min/max are defined as long.

Signed-off-by: jean-mickael.guerin@6wind.com
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:46 -04:00
Wei Yongjun
10a43cea7d sctp: fix panic when T4-rto timer expire on removed transport
If T4-rto timer is expired on a removed transport, kernel panic
will occur when we do failure management on that transport.
You can reproduce this use the following sequence:

Endpoint A                           Endpoint B
(ESTABLISHED)                        (ESTABLISHED)

            <-----------------      ASCONF
                                    (SRC=X)
ASCONF        ----------------->
(Delete IP Address = X)
            <-----------------      ASCONF-ACK
                                    (Success Indication)
            <-----------------      ASCONF
                                    (T4-rto timer expire)

This patch fixed the problem.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:46 -04:00
Wei Yongjun
6345b19985 sctp: fix panic when T2-shutdown timer expire on removed transport
If T2-shutdown timer is expired on a removed transport, kernel
panic will occur when we do failure management on that transport.
You can reproduce this use the following sequence:

  Endpoint A                           Endpoint B
  (ESTABLISHED)                        (ESTABLISHED)

                <-----------------      SHUTDOWN
                                        (SRC=X)
  ASCONF        ----------------->
  (Delete IP Address = X)
                <-----------------      ASCONF-ACK
                                        (Success Indication)
                <-----------------      SHUTDOWN
                                        (T2-shutdown timer expire)
This patch fixed the problem.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:46 -04:00
Wei Yongjun
a2c395846c sctp: fix to only enable IPv6 address support on PF_INET6 socket
If socket is create by PF_INET type, it can not used IPv6 address
to send/recv DATA. So only enable IPv6 address support on PF_INET6
socket.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:46 -04:00
Wei Yongjun
4553e88d87 sctp: fix a typo in net/sctp/sm_statetable.c
Just fix a typo in net/sctp/sm_statetable.c.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:45 -04:00
Wei Yongjun
945e5abcee sctp: fix the error code when ASCONF is received with invalid address
Use Unresolvable Address error cause instead of Invalid Mandatory
Parameter error cause when process ASCONF chunk with invalid address
since address parameters are not mandatory in the ASCONF chunk.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:45 -04:00
Wei Yongjun
a987f762ca sctp: fix report unrecognized parameter in ACSONF-ACK
RFC5061 Section 5.2.  Upon Reception of an ASCONF Chunk

V2)  In processing the chunk, the receiver should build a
     response message with the appropriate error TLVs, as
     specified in the Parameter type bits, for any ASCONF
     Parameter it does not understand.  To indicate an
     unrecognized parameter, Cause Type 8 should be used as
     defined in the ERROR in Section 3.3.10.8, [RFC4960].  The
     endpoint may also use the response to carry rejections for
     other reasons, such as resource shortages, etc., using the
     Error Cause TLV and an appropriate error condition.

So we should indicate an unrecognized parameter with error
SCTP_ERROR_UNKNOWN_PARAM in ACSONF-ACK chunk, not
SCTP_ERROR_INV_PARAM.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:45 -04:00
Wei Yongjun
a84db7949e sctp: fix error cause codes of ADD-IP extension
RFC5061 had changed the error cause codes for Dynamic Address
Reconfiguration As the following:

       Cause Code
       Value          Cause Code
       ---------      ----------------
       0x00A0          Request to Delete Last Remaining IP Address
       0x00A1          Operation Refused Due to Resource Shortage
       0x00A2          Request to Delete Source IP Address
       0x00A3          Association Aborted Due to Illegal ASCONF-ACK
       0x00A4          Request Refused - No Authorization

This patch fix the error cause codes.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
2009-06-03 09:14:45 -04:00
Haiying Wang
047584ce94 net/ucc_geth: Add SGMII support for UEC GETH driver
Signed-off-by: Haiying Wang <Haiying.Wang@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:52:47 -07:00
Haiying Wang
fbcc0e2ce5 fsl_pq_mido: Set the first UCC as the mii management interface master
Current code makes the UCC whose register range includes the current mdio
register to be the MII managemnt interface master of the QE. If there is more
than one mdio bus for QE, the UCC of the last mdio bus will be the MII
management interface master which will make the primary mdio bus working
unproperly, e.g. can not get the right clock. Normally the primary mdio bus is
the first UEC's mdio bus.
This patch allows the first UCC to be the MII management interface master of the
multiple UCC mdio buses.

Signed-off-by: Haiying Wang <Haiying.Wang@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:52:46 -07:00
Haiying Wang
32d0c1e1be net/phy/marvell: update m88e1111 support for SGMII mode
Disable fiber/copper auto selection for Marvell m88e1111 SGMII support.

Signed-off-by: Haiying Wang <Haiying.Wang@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:52:45 -07:00
Eric Dumazet
e5b9215ef9 net: skb cleanup
Can remove anonymous union now it has one field.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:51:05 -07:00
Eric Dumazet
adf30907d6 net: skb->dst accessors
Define three accessors to get/set dst attached to a skb

struct dst_entry *skb_dst(const struct sk_buff *skb)

void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

void skb_dst_drop(struct sk_buff *skb)
This one should replace occurrences of :
dst_release(skb->dst)
skb->dst = NULL;

Delete skb->dst field

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:51:04 -07:00
Eric Dumazet
511c3f92ad net: skb->rtable accessor
Define skb_rtable(const struct sk_buff *skb) accessor to get rtable from skb

Delete skb->rtable field

Setting rtable is not allowed, just set dst instead as rtable is an alias.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:51:02 -07:00
Eric Dumazet
dfbf97f3ac net: add _skb_dst opaque field
struct sk_buff uses one union to define dst and rtable fields.

We want to replace direct access to these pointers by accessors.

First patch adds a new "unsigned long _skb_dst;" opaque field
in this union.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:51:01 -07:00
Bruce Allan
3be8c940a6 e1000e: bump the version number
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:37 -07:00
Bruce Allan
37289d9c1e e1000e: workaround a Tx hang on 82577/82578
With bi-directional stress traffic, the receiver could hang causing the
hardware to stop and a "Detected Tx Unit Hang" message dumped to the system
logfile.  Temporarily workaround this issue by disabling Tx flow control by
default.  The issue is currently being investigated and a follow-on patch
will be provided to revert this when it is resolved.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:36 -07:00
Bruce Allan
a4f58f5455 e1000e: add support for 82577/82578 GbE LOM parts
This patch provides support for the next generation Intel desktop
and mobile gigabit ethernet LOM adapters.  These adapters are the
follow-on parts to the LOMs tied to the prior ICH chipsets and are
comprised of a MAC in the PCH chipset and an external PHY (82577 for
mobile and 82578 for desktop versions).  New features consist of PHY
wakeup to save power by completely turning off the MAC while in Sx
state, and 4K jumbo frames.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:34 -07:00
Bruce Allan
2adc55c959 e1000e: specify max supported frame size in adapter struct
By putting the maximum frame size supported by the hardware into the
adapter structure, the change_mtu entry point function can be cleaned
up of checks for all the different max frame sizes supported by

Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:33 -07:00
Bruce Allan
3ec2a2b80f e1000e: correct flow control thresholds
The flow control thresholds, i.e. high and low watermarks of the Rx
FIFO for when the hardware should transmit PAUSE frames (XON and XOFF,
respectively), need to be tuned for more efficient use of the FIFO.
The logic to set the thresholds for parts that support early-receive
(ERT) was also wrong in that it should check whether jumbo frames are
in use.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:33 -07:00
Bruce Allan
918d7197aa e1000e: do not attempt to disable smart powerdown if not supported
During reset, the driver was attempting to disable the Smart Powerdown
feature even if the part does not support Smart Powerdown.  Check for
support before attempting to disable the feature.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:32 -07:00
Bruce Allan
6e50912a44 e1000e: enable CRC stripping by default
CRC stripping should be enabled by default but was not if it was not
specified as a module parameter.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03 02:46:31 -07:00
David S. Miller
b2f8f7525c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
	drivers/net/forcedeth.c
2009-06-03 02:43:41 -07:00
Yevgeny Petrilin
d455e5b165 mlx4_en: Updated driver version
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:36:32 -07:00
Yevgeny Petrilin
e486973e9c mlx4_en: Added vlan_features support
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:08 -07:00
Yevgeny Petrilin
f813cad836 mlx4_en: multiqueue support
By default the driver opens 8 TX queues (defined by MLX4_EN_NUM_TX_RINGS).
If the driver is configured to support Per Priority Flow Control, we open
8 additional TX rings.
dev->real_num_tx_queues is always set to be MLX4_EN_NUM_TX_RINGS.
The mlx4_en_select_queue() function uses standard hashing (skb_tx_hash)
in case that PPFC is not supported or the skb contain a vlan tag,
otherwise the queue is selected according to vlan priority.

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:06 -07:00
Yevgeny Petrilin
3db36fb2c8 mlx4_en: Coalescing target is equal for all mtu's
The interrupt moderation should not depend on number of incoming
bytes, but on number of incoming packets.
The previous scheme caused very high interrupts rate for small
messages when big MTU was configured.

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:06 -07:00
Yevgeny Petrilin
3c2fa83f9c mlx4_en: Work with part of the ports.
If the initialization of one of the ports failed,
there is no need to fail the other one as well.

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:05 -07:00
Yevgeny Petrilin
9e47edaa1a mlx4_en renamed en_params.c to en_ethtool.c
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:04 -07:00
Yevgeny Petrilin
a2b28737a2 mlx4_en: Moved all module parameters handling to en_main.c
en_params.c file now only handles Ethtool functionality

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:03 -07:00
Yevgeny Petrilin
453a608277 mlx4_en: Giving interface name in debug messages
For each debug message, the message will show interface name in case
that the net device was registered, and PCI bus ID with port number
if we were not registered yet. Messages that are not port/netdev specific
stayed in the old format

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:29:03 -07:00
Minoru Usui
12186be7d2 net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
This patch fixes a bug which unconfigured struct tcf_proto keeps
chaining in tc_ctl_tfilter(), and avoids kernel panic in
cls_cgroup_classify() when we use cls_cgroup.

When we execute 'tc filter add', tcf_proto is allocated, initialized
by classifier's init(), and chained.  After it's chained,
tc_ctl_tfilter() calls classifier's change().  When classifier's
change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.

In addition, cls_cgroup is initialized in change() not in init().  It
accesses unconfigured struct tcf_proto which is chained before
change(), then hits Oops.

Signed-off-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Tested-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 02:17:34 -07:00
Neil Horman
ea30e11970 e1000: add missing length check to e1000 receive routine
Patch to fix bad length checking in e1000.  E1000 by default does two
things:

1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
doing an skb_put

Since the e1000 driver isn't written to support receiving packets that span
multiple rx buffers, it checks the End of Packet bit of every frame, and
discards it if its not set.  This places us in a situation where, if we have a
spanning packet, the first part is discarded, but the second part is not (since
it is the end of packet, and it passes the EOP bit test).  If the second part of
the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
underflow the length, and wind up in skb_over_panic, when we try to skb_put a
huge number of bytes into the skb.  This amounts to a remote DOS attack through
careful selection of frame size in relation to interface MTU.  The fix for this
is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
small frames from causing the underflow described above

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Tested-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 01:29:58 -07:00