kernel/git/stable/linux-stable.git/drivers/net/e1000, branch linux-2.6.29.y

e1000: add missing length check to e1000 receive routine

2009-06-15T16:40:10+00:00

commit ea30e11970a96cfe5e32c03a29332554573b4a10 upstream. Patch to fix bad length checking in e1000. E1000 by default does two things: 1) Spans rx descriptors for packets that don't fit into 1 skb on recieve 2) Strips the crc from a frame by subtracting 4 bytes from the length prior to doing an skb_put Since the e1000 driver isn't written to support receiving packets that span multiple rx buffers, it checks the End of Packet bit of every frame, and discards it if its not set. This places us in a situation where, if we have a spanning packet, the first part is discarded, but the second part is not (since it is the end of packet, and it passes the EOP bit test). If the second part of the frame is small (4 bytes or less), we subtract 4 from it to remove its crc, underflow the length, and wind up in skb_over_panic, when we try to skb_put a huge number of bytes into the skb. This amounts to a remote DOS attack through careful selection of frame size in relation to interface MTU. The fix for this is already in the e1000e driver, as well as the e1000 sourceforge driver, but no one ever pushed it to e1000. This is lifted straight from e1000e, and prevents small frames from causing the underflow described above Signed-off-by: Neil Horman Tested-by: Andy Gospodarek Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

e1000: fix virtualization bug

2009-05-18T23:34:39+00:00

[STABLE] backport upstream commit e151a60ad1faffb6241cf7eb6846353df1f33a32 a recent fix to e1000 (commit 15b2bee2) caused KVM/QEMU/VMware based virtualized e1000 interfaces to begin failing when resetting. This is because the driver in a virtual environment doesn't get to run instructions *AT ALL* when an interrupt is asserted. The interrupt code runs immediately and this recent bug fix allows an interrupt to be possible when the interrupt handler will reject it (due to the new code), when being called from any path in the driver that holds the E1000_RESETTING flag. the driver should use the __E1000_DOWN flag instead of the __E1000_RESETTING flag to prevent interrupt execution while reconfiguring the hardware. Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

e1000: Fix PCI enable to honor the need_ioport flag

2009-02-03T23:18:01+00:00

On machine were no IO ports are assigned the call to pci_enable_device() will fail, even if need_ioport is false, we need to use pci_enable_device_mem() here. Signed-off-by: Karsten Keil Signed-off-by: David S. Miller

e1000: fix bug with shared interrupt during reset

2009-01-28T00:41:58+00:00

A nasty bug was found where an MTU change (or anything else that caused a reset) could race with the interrupt code. The interrupt code was entered by a shared interrupt during the MTU change. This change prevents the interrupt code from running while the driver is in the middle of its reset path. Signed-off-by: Jesse Brandeburg Signed-off-by: David S. Miller

trivial: fix then -> than typos in comments and documentation

2009-01-06T10:28:06+00:00

- (better, more, bigger ...) then -> (...) than Signed-off-by: Frederik Schwarzer Signed-off-by: Jiri Kosina

net: Remove unused netdev arg from some NAPI interfaces.

2008-12-23T04:43:12+00:00

When the napi api was changed to separate its 1:1 binding to the net_device struct, the netif_rx_[prep|schedule|complete] api failed to remove the now vestigual net_device structure parameter. This patch cleans up that api by properly removing it.. Signed-off-by: Neil Horman Signed-off-by: David S. Miller

e1000: e1000_adapter->polling_netdev is useless

2008-12-04T06:07:10+00:00

Commit bea3348eef27e6044b6161fd04c3152215f96411 "[NET]: Make NAPI polling independent of struct net_device objects." made NAPI polling to be independent of net_device. So e1000_adapter->polling_netdev is no longer used. Kill it. Signed-off-by: Wang Chen Signed-off-by: David S. Miller

e1000: cleanup link up/down messages

2008-11-27T08:22:45+00:00

The system log messages created on a link status change need to follow a specific format to work with tools some customers use. This also makes the messages consistant with other Intel driver link messages. Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

netdev: add more functions to netdevice ops

2008-11-21T04:14:53+00:00

This patch moves neigh_setup and hard_start_xmit into the network device ops structure. For bisection, fix all the previously converted drivers as well. Bonding driver took the biggest hit on this. Added a prefetch of the hard_start_xmit in the fast path to try and reduce any impact this would have. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller

e1000: convert to net_device_ops

2008-11-20T06:42:50+00:00

Convert to new network device ops interface. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller