From c63eddb200690023e7c67f4dd9f132ad91660517 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Thu, 10 Apr 2008 15:06:14 -0500 Subject: sky2: missing chip name for Yukon Supreme Any usage of sky2 on new Yukon Supreme would cause a NULL dereference. The chip is very new, so the support is still untested; vendor has not sent any eval hardware. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik --- drivers/net/sky2.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/net') diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c index 853bce0ac47..f226bcac7d1 100644 --- a/drivers/net/sky2.c +++ b/drivers/net/sky2.c @@ -154,6 +154,7 @@ static const char *yukon2_name[] = { "EC", /* 0xb6 */ "FE", /* 0xb7 */ "FE+", /* 0xb8 */ + "Supreme", /* 0xb9 */ }; static void sky2_set_multicast(struct net_device *dev); -- cgit v1.2.3 From 9a3c243d7d87f401682247dbeff94067d814c192 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Fri, 11 Apr 2008 14:05:50 +0200 Subject: fs_enet: Don't call NAPI functions when NAPI is not used. fs_enet_close() calls napi_disable() unconditionally. This patch skips the call when use_napi isn't set. Signed-off-by: Laurent Pinchart Signed-off-by: Jeff Garzik --- drivers/net/fs_enet/fs_enet-main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c index af869cf9ae7..940e2041ba3 100644 --- a/drivers/net/fs_enet/fs_enet-main.c +++ b/drivers/net/fs_enet/fs_enet-main.c @@ -835,7 +835,8 @@ static int fs_enet_close(struct net_device *dev) netif_stop_queue(dev); netif_carrier_off(dev); - napi_disable(&fep->napi); + if (fep->fpi->use_napi) + napi_disable(&fep->napi); phy_stop(fep->phydev); spin_lock_irqsave(&fep->lock, flags); -- cgit v1.2.3 From 3d137fdd16b26be31a653f83d6ce4d3a1ed8701e Mon Sep 17 00:00:00 2001 From: Joakim Tjernlund Date: Fri, 11 Apr 2008 00:54:43 +0200 Subject: ucc_geth: fix non-functional fixed phy support The new Fixed PHY method, fixed-link property, isn't impl. for ucc_geth which makes fixed PHYs non functional. Add support for the new method to restore the Fixed PHY functionality. Signed-off-by: Joakim Tjernlund Signed-off-by: Li Yang Signed-off-by: Jeff Garzik --- drivers/net/ucc_geth.c | 53 ++++++++++++++++++++++++++++---------------------- 1 file changed, 30 insertions(+), 23 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c index 8cc316653a3..0ee4c168e4c 100644 --- a/drivers/net/ucc_geth.c +++ b/drivers/net/ucc_geth.c @@ -3833,6 +3833,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma struct device_node *phy; int err, ucc_num, max_speed = 0; const phandle *ph; + const u32 *fixed_link; const unsigned int *prop; const char *sprop; const void *mac_addr; @@ -3923,18 +3924,38 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma ug_info->uf_info.regs = res.start; ug_info->uf_info.irq = irq_of_parse_and_map(np, 0); + fixed_link = of_get_property(np, "fixed-link", NULL); + if (fixed_link) { + ug_info->mdio_bus = 0; + ug_info->phy_address = fixed_link[0]; + phy = NULL; + } else { + ph = of_get_property(np, "phy-handle", NULL); + phy = of_find_node_by_phandle(*ph); - ph = of_get_property(np, "phy-handle", NULL); - phy = of_find_node_by_phandle(*ph); + if (phy == NULL) + return -ENODEV; - if (phy == NULL) - return -ENODEV; + /* set the PHY address */ + prop = of_get_property(phy, "reg", NULL); + if (prop == NULL) + return -1; + ug_info->phy_address = *prop; + + /* Set the bus id */ + mdio = of_get_parent(phy); + + if (mdio == NULL) + return -1; - /* set the PHY address */ - prop = of_get_property(phy, "reg", NULL); - if (prop == NULL) - return -1; - ug_info->phy_address = *prop; + err = of_address_to_resource(mdio, 0, &res); + of_node_put(mdio); + + if (err) + return -1; + + ug_info->mdio_bus = res.start; + } /* get the phy interface type, or default to MII */ prop = of_get_property(np, "phy-connection-type", NULL); @@ -3979,20 +4000,6 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma ug_info->numThreadsRx = UCC_GETH_NUM_OF_THREADS_4; } - /* Set the bus id */ - mdio = of_get_parent(phy); - - if (mdio == NULL) - return -1; - - err = of_address_to_resource(mdio, 0, &res); - of_node_put(mdio); - - if (err) - return -1; - - ug_info->mdio_bus = res.start; - if (netif_msg_probe(&debug)) printk(KERN_INFO "ucc_geth: UCC%1d at 0x%8x (irq = %d) \n", ug_info->uf_info.ucc_num + 1, ug_info->uf_info.regs, -- cgit v1.2.3 From 84b7901f8d5a17536ef2df7fd628ab865df8fe3a Mon Sep 17 00:00:00 2001 From: Atsushi Nemoto Date: Thu, 10 Apr 2008 23:30:07 +0900 Subject: macb: Call phy_disconnect on removing Call phy_disconnect() on remove routine. Otherwise the phy timer causes a kernel crash when unloading. Signed-off-by: Atsushi Nemoto Signed-off-by: Jeff Garzik --- drivers/net/macb.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/net') diff --git a/drivers/net/macb.c b/drivers/net/macb.c index 1d210ed4613..10fcea59755 100644 --- a/drivers/net/macb.c +++ b/drivers/net/macb.c @@ -1257,6 +1257,8 @@ static int __exit macb_remove(struct platform_device *pdev) if (dev) { bp = netdev_priv(dev); + if (bp->phy_dev) + phy_disconnect(bp->phy_dev); mdiobus_unregister(&bp->mii_bus); kfree(bp->mii_bus.irq); unregister_netdev(dev); -- cgit v1.2.3 From 72cfe92266540d8510946921a599f140a3d4aaa8 Mon Sep 17 00:00:00 2001 From: Atsushi Nemoto Date: Sat, 12 Apr 2008 00:58:14 +0900 Subject: macb: Use semicolon instead of comma for statement It seems no good reason to use comma here. Signed-off-by: Atsushi Nemoto Signed-off-by: Jeff Garzik --- drivers/net/macb.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/macb.c b/drivers/net/macb.c index 10fcea59755..489c7c3b90d 100644 --- a/drivers/net/macb.c +++ b/drivers/net/macb.c @@ -242,12 +242,12 @@ static int macb_mii_init(struct macb *bp) /* Enable managment port */ macb_writel(bp, NCR, MACB_BIT(MPE)); - bp->mii_bus.name = "MACB_mii_bus", - bp->mii_bus.read = &macb_mdio_read, - bp->mii_bus.write = &macb_mdio_write, - bp->mii_bus.reset = &macb_mdio_reset, - bp->mii_bus.id = bp->pdev->id, - bp->mii_bus.priv = bp, + bp->mii_bus.name = "MACB_mii_bus"; + bp->mii_bus.read = &macb_mdio_read; + bp->mii_bus.write = &macb_mdio_write; + bp->mii_bus.reset = &macb_mdio_reset; + bp->mii_bus.id = bp->pdev->id; + bp->mii_bus.priv = bp; bp->mii_bus.dev = &bp->dev->dev; pdata = bp->pdev->dev.platform_data; -- cgit v1.2.3 From a376e79c6079c2ba6c5fadb0e85a3bb7e465ad89 Mon Sep 17 00:00:00 2001 From: Ayaz Abdulla Date: Thu, 10 Apr 2008 21:30:35 -0700 Subject: forcedeth: mac address fix This critical patch fixes a mac address issue recently introduced. If the device's mac address was in correct order and the flag NVREG_TRANSMITPOLL_MAC_ADDR_REV was set, during nv_remove the flag would get cleared. During next load, the mac address would get reversed because the flag is missing. As it has been indicated previously, the flag is cleared across a low power transition. Therefore, the driver should set the mac address back into the reversed order when clearing the flag. Also, the driver should set back the flag after a low power transition to protect against kexec command calling nv_probe a second time. Signed-off-by: Ayaz Abdulla Cc: "Yinghai Lu" Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/forcedeth.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c index 419f533006a..9f088a47d8b 100644 --- a/drivers/net/forcedeth.c +++ b/drivers/net/forcedeth.c @@ -5316,8 +5316,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i /* check the workaround bit for correct mac address order */ txreg = readl(base + NvRegTransmitPoll); - if ((txreg & NVREG_TRANSMITPOLL_MAC_ADDR_REV) || - (id->driver_data & DEV_HAS_CORRECT_MACADDR)) { + if (id->driver_data & DEV_HAS_CORRECT_MACADDR) { /* mac address is already in correct order */ dev->dev_addr[0] = (np->orig_mac[0] >> 0) & 0xff; dev->dev_addr[1] = (np->orig_mac[0] >> 8) & 0xff; @@ -5325,6 +5324,22 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i dev->dev_addr[3] = (np->orig_mac[0] >> 24) & 0xff; dev->dev_addr[4] = (np->orig_mac[1] >> 0) & 0xff; dev->dev_addr[5] = (np->orig_mac[1] >> 8) & 0xff; + } else if (txreg & NVREG_TRANSMITPOLL_MAC_ADDR_REV) { + /* mac address is already in correct order */ + dev->dev_addr[0] = (np->orig_mac[0] >> 0) & 0xff; + dev->dev_addr[1] = (np->orig_mac[0] >> 8) & 0xff; + dev->dev_addr[2] = (np->orig_mac[0] >> 16) & 0xff; + dev->dev_addr[3] = (np->orig_mac[0] >> 24) & 0xff; + dev->dev_addr[4] = (np->orig_mac[1] >> 0) & 0xff; + dev->dev_addr[5] = (np->orig_mac[1] >> 8) & 0xff; + /* + * Set orig mac address back to the reversed version. + * This flag will be cleared during low power transition. + * Therefore, we should always put back the reversed address. + */ + np->orig_mac[0] = (dev->dev_addr[5] << 0) + (dev->dev_addr[4] << 8) + + (dev->dev_addr[3] << 16) + (dev->dev_addr[2] << 24); + np->orig_mac[1] = (dev->dev_addr[1] << 0) + (dev->dev_addr[0] << 8); } else { /* need to reverse mac address to correct order */ dev->dev_addr[0] = (np->orig_mac[1] >> 8) & 0xff; @@ -5595,7 +5610,9 @@ out: static int nv_resume(struct pci_dev *pdev) { struct net_device *dev = pci_get_drvdata(pdev); + u8 __iomem *base = get_hwbase(dev); int rc = 0; + u32 txreg; if (!netif_running(dev)) goto out; @@ -5606,6 +5623,11 @@ static int nv_resume(struct pci_dev *pdev) pci_restore_state(pdev); pci_enable_wake(pdev, PCI_D0, 0); + /* restore mac address reverse flag */ + txreg = readl(base + NvRegTransmitPoll); + txreg |= NVREG_TRANSMITPOLL_MAC_ADDR_REV; + writel(txreg, base + NvRegTransmitPoll); + rc = nv_open(dev); out: return rc; -- cgit v1.2.3 From c500cb265e35c76d741714a61bc635e0f02d64d2 Mon Sep 17 00:00:00 2001 From: Sonic Zhang Date: Thu, 10 Apr 2008 21:30:37 -0700 Subject: smc91x driver: fix bug: print warning only in interrupt mode http://blackfin.uclinux.org/gf/project/uclinux-dist/tracker/?action=TrackerItemEdit&tracker_item_id=3956 Signed-off-by: Sonic Zhang Signed-off-by: Bryan Wu Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/smc91x.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/net') diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c index 4020e9e955b..63a54e29d56 100644 --- a/drivers/net/smc91x.c +++ b/drivers/net/smc91x.c @@ -1326,9 +1326,11 @@ static irqreturn_t smc_interrupt(int irq, void *dev_id) SMC_SET_INT_MASK(mask); spin_unlock(&lp->lock); +#ifndef CONFIG_NET_POLL_CONTROLLER if (timeout == MAX_IRQ_LOOPS) PRINTK("%s: spurious interrupt (mask = 0x%02x)\n", dev->name, mask); +#endif DBG(3, "%s: Interrupt done (%d loops)\n", dev->name, MAX_IRQ_LOOPS - timeout); -- cgit v1.2.3 From 5a81f14330ce70bc256b624593768fd1b4170d27 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Thu, 10 Apr 2008 21:30:38 -0700 Subject: sc92031: sysfs link missing Add missing sysfs device association. Compile tested only -ENOHW. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=10380 Signed-off-by: Stephen Hemminger Cc: Cesar Eduardo Barros Cc: Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/sc92031.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/net') diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c index 37b42394560..15fcee55284 100644 --- a/drivers/net/sc92031.c +++ b/drivers/net/sc92031.c @@ -1446,6 +1446,7 @@ static int __devinit sc92031_probe(struct pci_dev *pdev, } pci_set_drvdata(pdev, dev); + SET_NETDEV_DEV(dev, &pdev->dev); #if SC92031_USE_BAR == 0 dev->mem_start = pci_resource_start(pdev, SC92031_USE_BAR); -- cgit v1.2.3 From 44fb3126d7e6fb411775551b4653643f1d28ebe9 Mon Sep 17 00:00:00 2001 From: Thomas Klein Date: Fri, 4 Apr 2008 15:04:53 +0200 Subject: ehea: Fix DLPAR memory add support This patch fixes two weaknesses in send/receive packet handling which may lead to kernel panics during DLPAR memory add operations. Signed-off-by: Thomas Klein Signed-off-by: Jeff Garzik --- drivers/net/ehea/ehea.h | 3 ++- drivers/net/ehea/ehea_main.c | 24 ++++++++++++++++++++++-- 2 files changed, 24 insertions(+), 3 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h index 93b7fb24696..a8d3280923e 100644 --- a/drivers/net/ehea/ehea.h +++ b/drivers/net/ehea/ehea.h @@ -40,7 +40,7 @@ #include #define DRV_NAME "ehea" -#define DRV_VERSION "EHEA_0089" +#define DRV_VERSION "EHEA_0090" /* eHEA capability flags */ #define DLPAR_PORT_ADD_REM 1 @@ -371,6 +371,7 @@ struct ehea_port_res { struct ehea_q_skb_arr rq2_skba; struct ehea_q_skb_arr rq3_skba; struct ehea_q_skb_arr sq_skba; + int sq_skba_size; spinlock_t netif_queue; int queue_stopped; int swqe_refill_th; diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c index 07c742dd3f0..f460b623c07 100644 --- a/drivers/net/ehea/ehea_main.c +++ b/drivers/net/ehea/ehea_main.c @@ -349,7 +349,8 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes) pr->rq1_skba.os_skbs = 0; if (unlikely(test_bit(__EHEA_STOP_XFER, &ehea_driver_flags))) { - pr->rq1_skba.index = index; + if (nr_of_wqes > 0) + pr->rq1_skba.index = index; pr->rq1_skba.os_skbs = fill_wqes; return; } @@ -1464,7 +1465,9 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr, init_attr->act_nr_rwqes_rq2, init_attr->act_nr_rwqes_rq3); - ret = ehea_init_q_skba(&pr->sq_skba, init_attr->act_nr_send_wqes + 1); + pr->sq_skba_size = init_attr->act_nr_send_wqes + 1; + + ret = ehea_init_q_skba(&pr->sq_skba, pr->sq_skba_size); ret |= ehea_init_q_skba(&pr->rq1_skba, init_attr->act_nr_rwqes_rq1 + 1); ret |= ehea_init_q_skba(&pr->rq2_skba, init_attr->act_nr_rwqes_rq2 + 1); ret |= ehea_init_q_skba(&pr->rq3_skba, init_attr->act_nr_rwqes_rq3 + 1); @@ -2621,6 +2624,22 @@ void ehea_purge_sq(struct ehea_qp *orig_qp) } } +void ehea_flush_sq(struct ehea_port *port) +{ + int i; + + for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++) { + struct ehea_port_res *pr = &port->port_res[i]; + int swqe_max = pr->sq_skba_size - 2 - pr->swqe_ll_count; + int k = 0; + while (atomic_read(&pr->swqe_avail) < swqe_max) { + msleep(5); + if (++k == 20) + break; + } + } +} + int ehea_stop_qps(struct net_device *dev) { struct ehea_port *port = netdev_priv(dev); @@ -2845,6 +2864,7 @@ static void ehea_rereg_mrs(struct work_struct *work) if (dev->flags & IFF_UP) { down(&port->port_lock); netif_stop_queue(dev); + ehea_flush_sq(port); ret = ehea_stop_qps(dev); if (ret) { up(&port->port_lock); -- cgit v1.2.3 From 16a79142e51f9eedbf3ae9a20d9cdb2f88c86acc Mon Sep 17 00:00:00 2001 From: Krzysztof Halasa Date: Sat, 12 Apr 2008 10:10:40 +0200 Subject: Mark generic HDLC + PPP as broken. PPP support in generic HDLC in Linux 2.6.25 is broken and will cause a kernel panic when a device configured in PPP mode is activated. It will be replaced by new PPP implementation after Linux 2.6.25 is released. This affects only PPP support in generic HDLC (mostly Hitachi SCA and SCA-II based drivers, wanxl, and few others). Standalone syncppp and async PPP support are not affected. Signed-off-by: Krzysztof Halasa Signed-off-by: Jeff Garzik --- drivers/net/wan/Kconfig | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig index a3df09ee729..8005dd16fb4 100644 --- a/drivers/net/wan/Kconfig +++ b/drivers/net/wan/Kconfig @@ -150,9 +150,13 @@ config HDLC_FR config HDLC_PPP tristate "Synchronous Point-to-Point Protocol (PPP) support" - depends on HDLC + depends on HDLC && BROKEN help Generic HDLC driver supporting PPP over WAN connections. + This module is currently broken and will cause a kernel panic + when a device configured in PPP mode is activated. + + It will be replaced by new PPP implementation in Linux 2.6.26. If unsure, say N. -- cgit v1.2.3 From 2de58e30db3f7e83592e22fb459dd6695b648889 Mon Sep 17 00:00:00 2001 From: Sergei Shtylyov Date: Sat, 12 Apr 2008 18:30:58 -0700 Subject: tg3: fix MMIO for PPC 44x platforms The driver stores the PCI resource addresses into 'unsigned long' variable before calling ioremap_nocache() on them. This warrants kernel oops when the registers are accessed on PPC 44x platforms which (being 32-bit) have PCI memory space mapped beyond 4 GB. The arch/ppc/ kernel has a fixup in ioremap() that creates an illusion that the PCI memory resource is mapped below 4 GB, but arch/powerpc/ code got rid of this trick, having instead CONFIG_RESOURCES_64BIT enabled. [ Bump driver version and release date -DaveM ] Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller --- drivers/net/tg3.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index d4655b2d1f3..96043c5746d 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c @@ -64,8 +64,8 @@ #define DRV_MODULE_NAME "tg3" #define PFX DRV_MODULE_NAME ": " -#define DRV_MODULE_VERSION "3.89" -#define DRV_MODULE_RELDATE "April 03, 2008" +#define DRV_MODULE_VERSION "3.90" +#define DRV_MODULE_RELDATE "April 12, 2008" #define TG3_DEF_MAC_MODE 0 #define TG3_DEF_RX_MODE 0 @@ -12578,7 +12578,8 @@ static int __devinit tg3_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) { static int tg3_version_printed = 0; - unsigned long tg3reg_base, tg3reg_len; + resource_size_t tg3reg_base; + unsigned long tg3reg_len; struct net_device *dev; struct tg3 *tp; int err, pm_cap; -- cgit v1.2.3 From 14daa02139dcb3193b2b0250c0720a23ef610c49 Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Sat, 12 Apr 2008 18:48:58 -0700 Subject: net: make struct tun_struct private to tun.c There's no reason for this to be in the header, and it just hurts recompile time. Signed-off-by: Rusty Russell Acked-by: Max Krasnyanskiy Signed-off-by: David S. Miller --- drivers/net/tun.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) (limited to 'drivers/net') diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 7b816a03295..970ec479344 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -67,9 +67,42 @@ #include #include +/* Uncomment to enable debugging */ +/* #define TUN_DEBUG 1 */ + #ifdef TUN_DEBUG static int debug; + +#define DBG if(tun->debug)printk +#define DBG1 if(debug==2)printk +#else +#define DBG( a... ) +#define DBG1( a... ) +#endif + +struct tun_struct { + struct list_head list; + unsigned long flags; + int attached; + uid_t owner; + gid_t group; + + wait_queue_head_t read_wait; + struct sk_buff_head readq; + + struct net_device *dev; + + struct fasync_struct *fasync; + + unsigned long if_flags; + u8 dev_addr[ETH_ALEN]; + u32 chr_filter[2]; + u32 net_filter[2]; + +#ifdef TUN_DEBUG + int debug; #endif +}; /* Network device part of the driver */ -- cgit v1.2.3 From e01bf1c83332c4653ffd30eed20a94a9c83d82b2 Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Sat, 12 Apr 2008 18:49:30 -0700 Subject: net: check for underlength tap writes If the user gives a packet under 14 bytes, we'll end up reading off the end of the skb (not oopsing, just reading off the end). Signed-off-by: Rusty Russell Acked-by: Max Krasnyanskiy Signed-off-by: David S. Miller --- drivers/net/tun.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 970ec479344..5b5d87585d9 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -286,8 +286,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv, return -EFAULT; } - if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) + if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) { align = NET_IP_ALIGN; + if (unlikely(len < ETH_HLEN)) + return -EINVAL; + } if (!(skb = alloc_skb(len + align, GFP_KERNEL))) { tun->dev->stats.rx_dropped++; -- cgit v1.2.3