mempolicy: ERR_PTR dereference in mpol_shared_policy_init()

[safe/jmp/linux-2.6] / drivers / net / mv643xx_eth.c

diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 1405a17..e345ec8 100644 (file)
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -54,8 +54,8 @@
 #include <linux/io.h>
 #include <linux/types.h>
 #include <linux/inet_lro.h>
+#include <linux/slab.h>
 #include <asm/system.h>
-#include <linux/list.h>
 
 static char mv643xx_eth_driver_name[] = "mv643xx_eth";
 static char mv643xx_eth_driver_version[] = "1.4";
@@ -656,6 +656,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                struct sk_buff *skb;
                int rx;
                struct rx_desc *rx_desc;
+               int size;
 
                skb = __skb_dequeue(&mp->rx_recycle);
                if (skb == NULL)
@@ -678,10 +679,11 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
 
                rx_desc = rxq->rx_desc_area + rx;
 
+               size = skb->end - skb->data;
                rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
-                                                 skb->data, mp->skb_size,
+                                                 skb->data, size,
                                                  DMA_FROM_DEVICE);
-               rx_desc->buf_size = mp->skb_size;
+               rx_desc->buf_size = size;
                rxq->rx_skb[rx] = skb;
                wmb();
                rx_desc->cmd_sts = BUFFER_OWNED_BY_DMA | RX_ENABLE_INTERRUPT;
@@ -880,7 +882,6 @@ static netdev_tx_t mv643xx_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 
                txq->tx_bytes += skb->len;
                txq->tx_packets++;
-               dev->trans_start = jiffies;
 
                entries_left = txq->tx_ring_size - txq->tx_desc_count;
                if (entries_left < MAX_SKB_FRAGS + 1)
@@ -1695,7 +1696,7 @@ static u32 uc_addr_filter_mask(struct net_device *dev)
                return 0;
 
        nibbles = 1 << (dev->dev_addr[5] & 0x0f);
-       list_for_each_entry(ha, &dev->uc.list, list) {
+       netdev_for_each_uc_addr(ha, dev) {
                if (memcmp(dev->dev_addr, ha->addr, 5))
                        return 0;
                if ((dev->dev_addr[5] ^ ha->addr[5]) & 0xf0)
@@ -1768,7 +1769,7 @@ static void mv643xx_eth_program_multicast_filter(struct net_device *dev)
        struct mv643xx_eth_private *mp = netdev_priv(dev);
        u32 *mc_spec;
        u32 *mc_other;
-       struct dev_addr_list *addr;
+       struct netdev_hw_addr *ha;
        int i;
 
        if (dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) {
@@ -1793,8 +1794,8 @@ oom:
        memset(mc_spec, 0, 0x100);
        memset(mc_other, 0, 0x100);
 
-       for (addr = dev->mc_list; addr != NULL; addr = addr->next) {
-               u8 *a = addr->da_addr;
+       netdev_for_each_mc_addr(ha, dev) {
+               u8 *a = ha->addr;
                u32 *table;
                int entry;
 
@@ -2607,10 +2608,9 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
                goto out;
 
        ret = -ENOMEM;
-       msp = kmalloc(sizeof(*msp), GFP_KERNEL);
+       msp = kzalloc(sizeof(*msp), GFP_KERNEL);
        if (msp == NULL)
                goto out;
-       memset(msp, 0, sizeof(*msp));
 
        msp->base = ioremap(res->start, res->end - res->start + 1);
        if (msp->base == NULL)
@@ -2845,6 +2845,7 @@ static const struct net_device_ops mv643xx_eth_netdev_ops = {
        .ndo_start_xmit         = mv643xx_eth_xmit,
        .ndo_set_rx_mode        = mv643xx_eth_set_rx_mode,
        .ndo_set_mac_address    = mv643xx_eth_set_mac_address,
+       .ndo_validate_addr      = eth_validate_addr,
        .ndo_do_ioctl           = mv643xx_eth_ioctl,
        .ndo_change_mtu         = mv643xx_eth_change_mtu,
        .ndo_tx_timeout         = mv643xx_eth_tx_timeout,