aboutsummaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/pppol2tp.c8
-rw-r--r--drivers/net/tun.c6
-rw-r--r--drivers/net/wireless/b43legacy/main.c2
-rw-r--r--drivers/net/wireless/libertas/cmdresp.c8
-rw-r--r--drivers/net/wireless/p54common.c20
-rw-r--r--drivers/net/wireless/p54common.h8
-rw-r--r--drivers/net/wireless/rndis_wlan.c8
7 files changed, 35 insertions, 25 deletions
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e0b072d9fdb..86e5dba079f 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -455,6 +455,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
skb_queue_len(&session->reorder_q));
__skb_unlink(skb, &session->reorder_q);
kfree_skb(skb);
+ sock_put(session->sock);
continue;
}
@@ -1110,6 +1111,8 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
again:
hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+ struct sk_buff *skb;
+
session = hlist_entry(walk, struct pppol2tp_session, hlist);
sk = session->sock;
@@ -1138,7 +1141,10 @@ again:
/* Purge any queued data */
skb_queue_purge(&sk->sk_receive_queue);
skb_queue_purge(&sk->sk_write_queue);
- skb_queue_purge(&session->reorder_q);
+ while ((skb = skb_dequeue(&session->reorder_q))) {
+ kfree_skb(skb);
+ sock_put(sk);
+ }
release_sock(sk);
sock_put(sk);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 038c1ef94d2..7b816a03295 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -663,7 +663,11 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
case SIOCSIFHWADDR:
{
/* try to set the actual net device's hw address */
- int ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+ int ret;
+
+ rtnl_lock();
+ ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+ rtnl_unlock();
if (ret == 0) {
/** Set the character device's hardware address. This is used when
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c39de422e22..5f3f34e1dbf 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(void)
#ifdef CONFIG_B43LEGACY_DMA
feat_dma = "D";
#endif
- printk(KERN_INFO "Broadcom 43xx driver loaded "
+ printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
"[ Features: %s%s%s%s%s, Firmware-ID: "
B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 159216a9190..bdc6a1cc210 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
}
resp = (void *)priv->upld_buf;
-
- curcmd = le16_to_cpu(resp->command);
-
+ curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command);
respcmd = le16_to_cpu(resp->command);
result = le16_to_cpu(resp->result);
@@ -572,9 +570,9 @@ int lbs_process_rx_command(struct lbs_private *priv)
respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
- if (resp->seqnum != resp->seqnum) {
+ if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) {
lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
- le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum));
+ le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum));
spin_unlock_irqrestore(&priv->driver_lock, flags);
ret = -1;
goto done;
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c
index 5cda49aff3a..d191e055a78 100644
--- a/drivers/net/wireless/p54common.c
+++ b/drivers/net/wireless/p54common.c
@@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
struct p54_common *priv = dev->priv;
struct eeprom_pda_wrap *wrap = NULL;
struct pda_entry *entry;
- int i = 0;
unsigned int data_len, entry_len;
void *tmp;
int err;
+ u8 *end = (u8 *)eeprom + len;
wrap = (struct eeprom_pda_wrap *) eeprom;
- entry = (void *)wrap->data + wrap->len;
- i += 2;
- i += le16_to_cpu(entry->len)*2;
- while (i < len) {
+ entry = (void *)wrap->data + le16_to_cpu(wrap->len);
+
+ /* verify that at least the entry length/code fits */
+ while ((u8 *)entry <= end - sizeof(*entry)) {
entry_len = le16_to_cpu(entry->len);
data_len = ((entry_len - 1) << 1);
+
+ /* abort if entry exceeds whole structure */
+ if ((u8 *)entry + sizeof(*entry) + data_len > end)
+ break;
+
switch (le16_to_cpu(entry->code)) {
case PDR_MAC_ADDRESS:
SET_IEEE80211_PERM_ADDR(dev, entry->data);
@@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
priv->version = *(u8 *)(entry->data + 1);
break;
case PDR_END:
- i = len;
+ /* make it overrun */
+ entry_len = len;
break;
}
entry = (void *)entry + (entry_len + 1)*2;
- i += 2;
- i += entry_len*2;
}
if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h
index a721334e20d..b67ff34e26f 100644
--- a/drivers/net/wireless/p54common.h
+++ b/drivers/net/wireless/p54common.h
@@ -53,10 +53,10 @@ struct pda_entry {
} __attribute__ ((packed));
struct eeprom_pda_wrap {
- u32 magic;
- u16 pad;
- u16 len;
- u32 arm_opcode;
+ __le32 magic;
+ __le16 pad;
+ __le16 len;
+ __le32 arm_opcode;
u8 data[0];
} __attribute__ ((packed));
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index d9460aed1f2..10b776c1adc 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
__le32 KeyLength;
u8 Bssid[6];
u8 Padding[6];
- __le64 KeyRSC;
+ u8 KeyRSC[8];
u8 KeyMaterial[32];
} __attribute__((packed));
@@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
struct usbnet *usbdev = dev->priv;
struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
struct NDIS_802_11_KEY ndis_key;
- int i, keyidx, ret;
+ int keyidx, ret;
u8 *addr;
keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
@@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
ndis_key.KeyIndex = cpu_to_le32(keyidx);
if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
- for (i = 0; i < 6; i++)
- ndis_key.KeyRSC |=
- cpu_to_le64(ext->rx_seq[i] << (i * 8));
+ memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-20 08:01:37 +0000