bcm driver copies a buffer length provided by userpace without checking it.
RxCntrlMsgBitMask is of type unsigned long so only makes sense to copy
sizeof(unsigned long) bytes.
Also, copy_from_user() returns the number of bytes that could not be copied.
The driver is returning that value as error code instead of -EFAULT.
This patch solves both issues.
Signed-off-by: Javier Martinez Canillas <martinez.javier@gmail.com>
Cc: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
While building latest Linus git, I hit the following:
CC [M] drivers/staging/bcm/Qos.o
drivers/staging/bcm/Qos.c: In function ‘PruneQueue’:
drivers/staging/bcm/Qos.c:367: error: ‘struct netdev_queue’ has no member named ‘tx_dropped’
drivers/staging/bcm/Qos.c: In function ‘flush_all_queues’:
drivers/staging/bcm/Qos.c:416: error: ‘struct netdev_queue’ has no member named ‘tx_dropped’
make[5]: *** [drivers/staging/bcm/Qos.o] Error 1
make[4]: *** [drivers/staging/bcm] Error 2
make[3]: *** [drivers/staging] Error 2
As well as:
CC [M] drivers/staging/bcm/Transmit.o
drivers/staging/bcm/Transmit.c: In function ‘SetupNextSend’:
drivers/staging/bcm/Transmit.c:163: error: ‘struct netdev_queue’ has no member named ‘tx_bytes’
drivers/staging/bcm/Transmit.c:164: error: ‘struct netdev_queue’ has no member named ‘tx_packets’
make[2]: *** [drivers/staging/bcm/Transmit.o] Error 1
tx_dropped/tx_bytes_tx_packets were removed in commit 1ac9ad13. This patch
converts bcm to use net_device_stats instead of netdev_queue.
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Andres Salomon <dilinger@queued.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* usb-next: (132 commits)
USB: uas: Use GFP_NOIO instead of GFP_KERNEL in I/O submission path
USB: uas: Ensure we only bind to a UAS interface
USB: uas: Rename sense pipe and sense urb to status pipe and status urb
USB: uas: Use kzalloc instead of kmalloc
USB: uas: Fix up the Sense IU
usb: musb: core: kill unneeded #include's
DA8xx: assign name to MUSB IRQ resource
usb: gadget: g_ncm added
usb: gadget: f_ncm.c added
usb: gadget: u_ether: prepare for NCM
usb: pch_udc: Fix setup transfers with data out
usb: pch_udc: Fix compile error, warnings and checkpatch warnings
usb: add ab8500 usb transceiver driver
USB: gadget: Implement runtime PM for MSM bus glue driver
USB: gadget: Implement runtime PM for ci13xxx gadget
USB: gadget: Add USB controller driver for MSM SoC
USB: gadget: Introduce ci13xxx_udc_driver struct
USB: gadget: Initialize ci13xxx gadget device's coherent DMA mask
USB: gadget: Fix "scheduling while atomic" bugs in ci13xxx_udc
USB: gadget: Separate out PCI bus code from ci13xxx_udc
...
The only checkpatch.pl issues remaining still remaining are line length
complaints.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
These are just small changes. Some grammar and wording changes. I added
new lines to the end of all the print statements.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
We can't call class_destroy() until after the driver has been deregistered.
It leads to a NULL deref on module unload.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This drops compatability for everything from 2.4 to 2.6.35. Now it only
works on the latest kernel.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch only changes:
1) spaces, tabs, and newline characters.
2) comment styles.
The compiled object file is the same before and after except for line
number changes.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch changes:
INT => int
ULONG => unsigned long
VOID => void
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1436) takes care of leftover references to
udev->autosuspend_delay that didn't get removed during the earlier
conversion to the runtime-PM autosuspend API.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
status is used to store negative error codes throughout. The only place
where this is a runtime bug is if create_worker_threads() fails.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
wrm() returns negative error codes so "ret" needs to be signed here.
There was place where wrm() returned positive EACCES instead of
negative -EACCES so I fixed that as well. Also a few checkpatch.pl
issues.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This was necessary in order to resolve some conflicts that happened
between -rc1 and -rc2 with the following files:
drivers/staging/bcm/Bcmchar.c
drivers/staging/intel_sst/intel_sst_app_interface.c
All should be resolved now.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Here's a patch against a copy of linux-next that I just cloned.
Don't pointlessly cast pointers returned by allocation functions that
return void pointers which are implicitly converted.
For drivers/staging/bcm/
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Switching to UINT because that's what the rest of this codebase uses.
Signed-off-by: Alejandro R. Sedeño <asedeno@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes some places that dereference user pointers directly instead
of using get_user().
Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS. The
original code modified the struct which "arg" was pointing to. I think
this was a bug in the original code and that we only wanted to write to
the OutputBuffer. Also with the original code you could read as much
memory as you wanted so I had to put a cap on OutputLength. The only
value of OutputLength that makes sense is sizeof(LINK_STATE) so now if
OutputLength is not sizeof(LINK_STATE) it returns -EINVAL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Change the regsister/unregister routines to generate better
messages, and control arrival of new frames when USB device is
unplugged.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Serious bug in original code, if app reads 10 bytes but 20 byte msg
received memory would get overwritten.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Use standard network statistics variables and routines.
Transmit counters are per queue, and skb mapping is already in
skb and does not need to be recomputed. Move SearchVcId to only
place it is used.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Since classification and queue control are separate, allow
classification even if device is down now; this avoids races
on startup/shutdown.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Use namespace tool from kernel scripts to identify dead code and
functions that should be static.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Eliminate global variable in transmit path
The Leader can be on the stack, and get rid of unnecessary timeval.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Remove dead fields, change fields that only have true/false to boolean;
and rearrange to save space.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Sparse caught several places where ioctl interface was incorrectly using user
memory. Fix all the ioctl cases for casting and __user annotation.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
This preserves the semantics of the original driver (unclassified packets
are dropped), but does it in a clean way; and fixes crash when packet
is sent to offline device.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
