Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: SNMP NAT: fix memory corruption
  [IRDA]: fixup type of ->lsap_state
  [IRDA]: fix 16/32 bit confusion
  [NET]: Fix "ntohl(ntohs" bugs
  [BNX2]: Use kmalloc instead of array
  [BNX2]: Fix bug in bnx2_nvram_write()
  [TG3]: Add some missing rx error counters

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 5ca99e26660af7f9b32f873e06bd3efd9ea4a313..54161aef3cac0cd763479a3a5bc9d7b00da1f83b 100644 (file)
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -55,8 +55,8 @@
 
 #define DRV_MODULE_NAME                "bnx2"
 #define PFX DRV_MODULE_NAME    ": "
-#define DRV_MODULE_VERSION     "1.4.39"
-#define DRV_MODULE_RELDATE     "March 22, 2006"
+#define DRV_MODULE_VERSION     "1.4.40"
+#define DRV_MODULE_RELDATE     "May 22, 2006"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -2945,7 +2945,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                int buf_size)
 {
        u32 written, offset32, len32;
-       u8 *buf, start[4], end[4];
+       u8 *buf, start[4], end[4], *flash_buffer = NULL;
        int rc = 0;
        int align_start, align_end;
 
@@ -2985,12 +2985,19 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                memcpy(buf + align_start, data_buf, buf_size);
        }
 
+       if (bp->flash_info->buffered == 0) {
+               flash_buffer = kmalloc(264, GFP_KERNEL);
+               if (flash_buffer == NULL) {
+                       rc = -ENOMEM;
+                       goto nvram_write_end;
+               }
+       }
+
        written = 0;
        while ((written < len32) && (rc == 0)) {
                u32 page_start, page_end, data_start, data_end;
                u32 addr, cmd_flags;
                int i;
-               u8 flash_buffer[264];
 
                /* Find the page_start addr */
                page_start = offset32 + written;
@@ -3061,7 +3068,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                }
 
                /* Loop to write the new data from data_start to data_end */
-               for (addr = data_start; addr < data_end; addr += 4, i++) {
+               for (addr = data_start; addr < data_end; addr += 4, i += 4) {
                        if ((addr == page_end - 4) ||
                                ((bp->flash_info->buffered) &&
                                 (addr == data_end - 4))) {
@@ -3109,6 +3116,9 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
        }
 
 nvram_write_end:
+       if (bp->flash_info->buffered == 0)
+               kfree(flash_buffer);
+
        if (align_start || align_end)
                kfree(buf);
        return rc;

diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index e1b33a25a25f504e2c246aa326471c0d76c2ea38..49ad60b726579e8bdf8fdf75cafa264cae44cc2b 100644 (file)
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -69,8 +69,8 @@
 
 #define DRV_MODULE_NAME                "tg3"
 #define PFX DRV_MODULE_NAME    ": "
-#define DRV_MODULE_VERSION     "3.57"
-#define DRV_MODULE_RELDATE     "Apr 28, 2006"
+#define DRV_MODULE_VERSION     "3.58"
+#define DRV_MODULE_RELDATE     "May 22, 2006"
 
 #define TG3_DEF_MAC_MODE       0
 #define TG3_DEF_RX_MODE                0
@@ -6488,6 +6488,10 @@ static void tg3_periodic_fetch_stats(struct tg3 *tp)
        TG3_STAT_ADD32(&sp->rx_frame_too_long_errors, MAC_RX_STATS_FRAME_TOO_LONG);
        TG3_STAT_ADD32(&sp->rx_jabbers, MAC_RX_STATS_JABBERS);
        TG3_STAT_ADD32(&sp->rx_undersize_packets, MAC_RX_STATS_UNDERSIZE);
+
+       TG3_STAT_ADD32(&sp->rxbds_empty, RCVLPC_NO_RCV_BD_CNT);
+       TG3_STAT_ADD32(&sp->rx_discards, RCVLPC_IN_DISCARDS_CNT);
+       TG3_STAT_ADD32(&sp->rx_errors, RCVLPC_IN_ERRORS_CNT);
 }
 
 static void tg3_timer(unsigned long __opaque)

diff --git a/include/net/irda/irlmp.h b/include/net/irda/irlmp.h
index 86aefb1fda5e0bba0f24210eb9864b63801fe913..c0c895d379ba1b10ed5a7b39e8c4da3405aea23e 100644 (file)
--- a/include/net/irda/irlmp.h
+++ b/include/net/irda/irlmp.h
@@ -112,7 +112,7 @@ struct lsap_cb {
 
        struct timer_list watchdog_timer;
 
-       IRLMP_STATE     lsap_state;  /* Connection state */
+       LSAP_STATE      lsap_state;  /* Connection state */
        notify_t        notify;      /* Indication/Confirm entry points */
        struct qos_info qos;         /* QoS for this connection */
 

diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index cd810f41af1a71db684a7787bde2bbc8e5d601f7..95278b22b669ab895903fe039fa3e7d2e1f56a25 100644 (file)
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
            skb->h.icmph->code != ICMP_FRAG_NEEDED)
                return;
 
-       spi = ntohl(ntohs(ipch->cpi));
+       spi = htonl(ntohs(ipch->cpi));
        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
                              spi, IPPROTO_COMP, AF_INET);
        if (!x)

diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index c622538455385d718f66e17e7f5c964d9404f723..688a2f29fadf67612805db5f73354b5afa2a3d76 100644 (file)
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1003,12 +1003,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
                
        return 1;
 
+err_addr_free:
+       kfree((unsigned long *)trap->ip_address);
+
 err_id_free:
        kfree(trap->id);
 
-err_addr_free:
-       kfree((unsigned long *)trap->ip_address);
-       
        return 0;
 }
 
@@ -1126,11 +1126,10 @@ static int snmp_parse_mangle(unsigned char *msg,
                struct snmp_v1_trap trap;
                unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
                
-               /* Discard trap allocations regardless */
-               kfree(trap.id);
-               kfree((unsigned long *)trap.ip_address);
-               
-               if (!ret)
+               if (ret) {
+                       kfree(trap.id);
+                       kfree((unsigned long *)trap.ip_address);
+               } else 
                        return ret;
                
        } else {

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index f285bbf296e28d79099887afa2882be75ddf32bc..8604c747bca5fa3d1353159e906ddfcec0da1290 100644 (file)
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
                        if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                u16 *ipcomp_hdr = (u16 *)xprth;
 
-                               fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1]));
+                               fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                        }
                        break;
                default:

diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 05eb67def39f17e9c9b84d9270fdbe6fe1ee2a87..48636436028ab2b1ce1b1dfee0bce70b545e0799 100644 (file)
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -208,7 +208,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
                return;
 
-       spi = ntohl(ntohs(ipcomph->cpi));
+       spi = htonl(ntohs(ipcomph->cpi));
        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
        if (!x)
                return;

diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 254f9074690011a66e0382fbef5f65892e81b32e..2d2e2b1919f40f70230c1527edbf8bb0c23d5fa4 100644 (file)
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -544,7 +544,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self,
 {
        struct sk_buff *tx_skb;
        int n;
-       __u32 tmp_be32, tmp_be16;
+       __u32 tmp_be32;
+       __be16 tmp_be16;
        __u8 *fp;
 
        IRDA_DEBUG(4, "%s()\n", __FUNCTION__);

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index b54971059f164136be5db7dbaea938548a4e4e15..891a6090cc099d2f88e15aa33ff68db982132d6e 100644 (file)
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
        case IPPROTO_COMP:
                if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
                        return -EINVAL;
-               *spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2)));
+               *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2)));
                *seq = 0;
                return 0;
        default: