[NET]: rtnl_link: fix use-after-free
[safe/jmp/linux-2.6] / drivers / net / smc911x.c
index bdd8702..76cc1d3 100644 (file)
@@ -55,8 +55,6 @@ static const char version[] =
                         )
 #endif
 
-
-#include <linux/config.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -79,7 +77,6 @@ static const char version[] =
 #include <linux/skbuff.h>
 
 #include <asm/io.h>
-#include <asm/irq.h>
 
 #include "smc911x.h"
 
@@ -118,13 +115,6 @@ struct smc911x_local {
         */
        struct sk_buff *pending_tx_skb;
 
-       /*
-        * these are things that the kernel wants me to keep, so users
-        * can find out semi-useless statistics of how well the card is
-        * performing
-        */
-       struct net_device_stats stats;
-
        /* version/revision of the SMC911x chip */
        u16 version;
        u16 revision;
@@ -150,6 +140,8 @@ struct smc911x_local {
        int tx_throttle;
        spinlock_t lock;
 
+       struct net_device *netdev;
+
 #ifdef SMC_USE_DMA
        /* DMA needs the physical address of the chip */
        u_long physaddr;
@@ -316,8 +308,8 @@ static void smc911x_reset(struct net_device *dev)
        if (lp->pending_tx_skb != NULL) {
                dev_kfree_skb (lp->pending_tx_skb);
                lp->pending_tx_skb = NULL;
-               lp->stats.tx_errors++;
-               lp->stats.tx_aborted_errors++;
+               dev->stats.tx_errors++;
+               dev->stats.tx_aborted_errors++;
        }
 }
 
@@ -436,7 +428,6 @@ static inline void smc911x_drop_pkt(struct net_device *dev)
  */
 static inline void      smc911x_rcv(struct net_device *dev)
 {
-       struct smc911x_local *lp = netdev_priv(dev);
        unsigned long ioaddr = dev->base_addr;
        unsigned int pkt_len, status;
        struct sk_buff *skb;
@@ -450,14 +441,14 @@ static inline void         smc911x_rcv(struct net_device *dev)
        pkt_len = (status & RX_STS_PKT_LEN_) >> 16;
        if (status & RX_STS_ES_) {
                /* Deal with a bad packet */
-               lp->stats.rx_errors++;
+               dev->stats.rx_errors++;
                if (status & RX_STS_CRC_ERR_)
-                       lp->stats.rx_crc_errors++;
+                       dev->stats.rx_crc_errors++;
                else {
                        if (status & RX_STS_LEN_ERR_)
-                               lp->stats.rx_length_errors++;
+                               dev->stats.rx_length_errors++;
                        if (status & RX_STS_MCAST_)
-                               lp->stats.multicast++;
+                               dev->stats.multicast++;
                }
                /* Remove the bad packet data from the RX FIFO */
                smc911x_drop_pkt(dev);
@@ -468,7 +459,7 @@ static inline void   smc911x_rcv(struct net_device *dev)
                if (unlikely(skb == NULL)) {
                        PRINTK( "%s: Low memory, rcvd packet dropped.\n",
                                dev->name);
-                       lp->stats.rx_dropped++;
+                       dev->stats.rx_dropped++;
                        smc911x_drop_pkt(dev);
                        return;
                }
@@ -481,6 +472,7 @@ static inline void   smc911x_rcv(struct net_device *dev)
                skb_put(skb,pkt_len-4);
 #ifdef SMC_USE_DMA
                {
+               struct smc911x_local *lp = netdev_priv(dev);
                unsigned int fifo;
                /* Lower the FIFO threshold if possible */
                fifo = SMC_GET_FIFO_INT();
@@ -499,14 +491,13 @@ static inline void         smc911x_rcv(struct net_device *dev)
                SMC_SET_RX_CFG(RX_CFG_RX_END_ALGN4_ | ((2<<8) & RX_CFG_RXDOFF_));
                SMC_PULL_DATA(data, pkt_len+2+3);
 
-               DBG(SMC_DEBUG_PKTS, "%s: Received packet\n", dev->name,);
+               DBG(SMC_DEBUG_PKTS, "%s: Received packet\n", dev->name);
                PRINT_PKT(data, ((pkt_len - 4) <= 64) ? pkt_len - 4 : 64);
                dev->last_rx = jiffies;
-               skb->dev = dev;
                skb->protocol = eth_type_trans(skb, dev);
                netif_rx(skb);
-               lp->stats.rx_packets++;
-               lp->stats.rx_bytes += pkt_len-4;
+               dev->stats.rx_packets++;
+               dev->stats.rx_bytes += pkt_len-4;
 #endif
        }
 }
@@ -618,8 +609,8 @@ static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                printk("%s: No Tx free space %d < %d\n",
                        dev->name, free, skb->len);
                lp->pending_tx_skb = NULL;
-               lp->stats.tx_errors++;
-               lp->stats.tx_dropped++;
+               dev->stats.tx_errors++;
+               dev->stats.tx_dropped++;
                dev_kfree_skb(skb);
                return 0;
        }
@@ -669,8 +660,8 @@ static void smc911x_tx(struct net_device *dev)
                        dev->name,
                        (SMC_GET_TX_FIFO_INF() & TX_FIFO_INF_TSUSED_) >> 16);
                tx_status = SMC_GET_TX_STS_FIFO();
-               lp->stats.tx_packets++;
-               lp->stats.tx_bytes+=tx_status>>16;
+               dev->stats.tx_packets++;
+               dev->stats.tx_bytes+=tx_status>>16;
                DBG(SMC_DEBUG_TX, "%s: Tx FIFO tag 0x%04x status 0x%04x\n",
                        dev->name, (tx_status & 0xffff0000) >> 16,
                        tx_status & 0x0000ffff);
@@ -678,22 +669,22 @@ static void smc911x_tx(struct net_device *dev)
                 * full-duplex mode */
                if ((tx_status & TX_STS_ES_) && !(lp->ctl_rfduplx &&
                    !(tx_status & 0x00000306))) {
-                       lp->stats.tx_errors++;
+                       dev->stats.tx_errors++;
                }
                if (tx_status & TX_STS_MANY_COLL_) {
-                       lp->stats.collisions+=16;
-                       lp->stats.tx_aborted_errors++;
+                       dev->stats.collisions+=16;
+                       dev->stats.tx_aborted_errors++;
                } else {
-                       lp->stats.collisions+=(tx_status & TX_STS_COLL_CNT_) >> 3;
+                       dev->stats.collisions+=(tx_status & TX_STS_COLL_CNT_) >> 3;
                }
                /* carrier error only has meaning for half-duplex communication */
                if ((tx_status & (TX_STS_LOC_ | TX_STS_NO_CARR_)) &&
                    !lp->ctl_rfduplx) {
-                       lp->stats.tx_carrier_errors++;
+                       dev->stats.tx_carrier_errors++;
                }
                if (tx_status & TX_STS_LATE_COLL_) {
-                       lp->stats.collisions++;
-                       lp->stats.tx_aborted_errors++;
+                       dev->stats.collisions++;
+                       dev->stats.tx_aborted_errors++;
                }
        }
 }
@@ -950,10 +941,11 @@ static void smc911x_phy_check_media(struct net_device *dev, int init)
  * of autonegotiation.)  If the RPC ANEG bit is cleared, the selection
  * is controlled by the RPC SPEED and RPC DPLX bits.
  */
-static void smc911x_phy_configure(void *data)
+static void smc911x_phy_configure(struct work_struct *work)
 {
-       struct net_device *dev = data;
-       struct smc911x_local *lp = netdev_priv(dev);
+       struct smc911x_local *lp = container_of(work, struct smc911x_local,
+                                               phy_configure);
+       struct net_device *dev = lp->netdev;
        unsigned long ioaddr = dev->base_addr;
        int phyaddr = lp->mii.phy_id;
        int my_phy_caps; /* My PHY capabilities */
@@ -967,11 +959,11 @@ static void smc911x_phy_configure(void *data)
         * We should not be called if phy_type is zero.
         */
        if (lp->phy_type == 0)
-                goto smc911x_phy_configure_exit;
+                goto smc911x_phy_configure_exit_nolock;
 
        if (smc911x_phy_reset(dev, phyaddr)) {
                printk("%s: PHY reset timed out\n", dev->name);
-               goto smc911x_phy_configure_exit;
+               goto smc911x_phy_configure_exit_nolock;
        }
        spin_lock_irqsave(&lp->lock, flags);
 
@@ -1040,6 +1032,7 @@ static void smc911x_phy_configure(void *data)
 
 smc911x_phy_configure_exit:
        spin_unlock_irqrestore(&lp->lock, flags);
+smc911x_phy_configure_exit_nolock:
        lp->work_pending = 0;
 }
 
@@ -1076,7 +1069,7 @@ static void smc911x_phy_interrupt(struct net_device *dev)
  * This is the main routine of the driver, to handle the device when
  * it needs some attention.
  */
-static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t smc911x_interrupt(int irq, void *dev_id)
 {
        struct net_device *dev = dev_id;
        unsigned long ioaddr = dev->base_addr;
@@ -1092,6 +1085,7 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
        /* Spurious interrupt check */
        if ((SMC_GET_IRQ_CFG() & (INT_CFG_IRQ_INT_ | INT_CFG_IRQ_EN_)) !=
                (INT_CFG_IRQ_INT_ | INT_CFG_IRQ_EN_)) {
+               spin_unlock_irqrestore(&lp->lock, flags);
                return IRQ_NONE;
        }
 
@@ -1120,11 +1114,11 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
                /* Handle various error conditions */
                if (status & INT_STS_RXE_) {
                        SMC_ACK_INT(INT_STS_RXE_);
-                       lp->stats.rx_errors++;
+                       dev->stats.rx_errors++;
                }
                if (status & INT_STS_RXDFH_INT_) {
                        SMC_ACK_INT(INT_STS_RXDFH_INT_);
-                       lp->stats.rx_dropped+=SMC_GET_RX_DROP();
+                       dev->stats.rx_dropped+=SMC_GET_RX_DROP();
                 }
                /* Undocumented interrupt-what is the right thing to do here? */
                if (status & INT_STS_RXDF_INT_) {
@@ -1139,8 +1133,8 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
                                cr &= ~MAC_CR_RXEN_;
                                SMC_SET_MAC_CR(cr);
                                DBG(SMC_DEBUG_RX, "%s: RX overrun\n", dev->name);
-                               lp->stats.rx_errors++;
-                               lp->stats.rx_fifo_errors++;
+                               dev->stats.rx_errors++;
+                               dev->stats.rx_fifo_errors++;
                        }
                        SMC_ACK_INT(INT_STS_RDFL_);
                }
@@ -1151,8 +1145,8 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
                                SMC_SET_MAC_CR(cr);
                                rx_overrun=1;
                                DBG(SMC_DEBUG_RX, "%s: RX overrun\n", dev->name);
-                               lp->stats.rx_errors++;
-                               lp->stats.rx_fifo_errors++;
+                               dev->stats.rx_errors++;
+                               dev->stats.rx_fifo_errors++;
                        }
                        SMC_ACK_INT(INT_STS_RDFO_);
                }
@@ -1229,7 +1223,7 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
                }
 #endif
 
-               /* Handle PHY interupt condition */
+               /* Handle PHY interrupt condition */
                if (status & INT_STS_PHY_INT_) {
                        DBG(SMC_DEBUG_MISC, "%s: PHY irq\n", dev->name);
                        smc911x_phy_interrupt(dev);
@@ -1252,7 +1246,7 @@ static irqreturn_t smc911x_interrupt(int irq, void *dev_id, struct pt_regs *regs
 
 #ifdef SMC_USE_DMA
 static void
-smc911x_tx_dma_irq(int dma, void *data, struct pt_regs *regs)
+smc911x_tx_dma_irq(int dma, void *data)
 {
        struct net_device *dev = (struct net_device *)data;
        struct smc911x_local *lp = netdev_priv(dev);
@@ -1286,7 +1280,7 @@ smc911x_tx_dma_irq(int dma, void *data, struct pt_regs *regs)
                "%s: TX DMA irq completed\n", dev->name);
 }
 static void
-smc911x_rx_dma_irq(int dma, void *data, struct pt_regs *regs)
+smc911x_rx_dma_irq(int dma, void *data)
 {
        struct net_device *dev = (struct net_device *)data;
        unsigned long ioaddr = dev->base_addr;
@@ -1304,11 +1298,10 @@ smc911x_rx_dma_irq(int dma, void *data, struct pt_regs *regs)
        lp->current_rx_skb = NULL;
        PRINT_PKT(skb->data, skb->len);
        dev->last_rx = jiffies;
-       skb->dev = dev;
        skb->protocol = eth_type_trans(skb, dev);
+       dev->stats.rx_packets++;
+       dev->stats.rx_bytes += skb->len;
        netif_rx(skb);
-       lp->stats.rx_packets++;
-       lp->stats.rx_bytes += skb->len;
 
        spin_lock_irqsave(&lp->lock, flags);
        pkts = (SMC_GET_RX_FIFO_INF() & RX_FIFO_INF_RXSUSED_) >> 16;
@@ -1332,7 +1325,7 @@ smc911x_rx_dma_irq(int dma, void *data, struct pt_regs *regs)
 static void smc911x_poll_controller(struct net_device *dev)
 {
        disable_irq(dev->irq);
-       smc911x_interrupt(dev->irq, dev, NULL);
+       smc911x_interrupt(dev->irq, dev);
        enable_irq(dev->irq);
 }
 #endif
@@ -1386,13 +1379,6 @@ static void smc911x_set_multicast_list(struct net_device *dev)
        unsigned int multicast_table[2];
        unsigned int mcr, update_multicast = 0;
        unsigned long flags;
-       /* table for flipping the order of 5 bits */
-       static const unsigned char invert5[] =
-               {0x00, 0x10, 0x08, 0x18, 0x04, 0x14, 0x0C, 0x1C,
-                0x02, 0x12, 0x0A, 0x1A, 0x06, 0x16, 0x0E, 0x1E,
-                0x01, 0x11, 0x09, 0x19, 0x05, 0x15, 0x0D, 0x1D,
-                0x03, 0x13, 0x0B, 0x1B, 0x07, 0x17, 0x0F, 0x1F};
-
 
        DBG(SMC_DEBUG_FUNC, "%s: --> %s\n", dev->name, __FUNCTION__);
 
@@ -1439,7 +1425,7 @@ static void smc911x_set_multicast_list(struct net_device *dev)
 
                cur_addr = dev->mc_list;
                for (i = 0; i < dev->mc_count; i++, cur_addr = cur_addr->next) {
-                       int position;
+                       u32 position;
 
                        /* do we have a pointer here? */
                        if (!cur_addr)
@@ -1449,12 +1435,10 @@ static void smc911x_set_multicast_list(struct net_device *dev)
                        if (!(*cur_addr->dmi_addr & 1))
                                 continue;
 
-                       /* only use the low order bits */
-                       position = crc32_le(~0, cur_addr->dmi_addr, 6) & 0x3f;
+                       /* upper 6 bits are used as hash index */
+                       position = ether_crc(ETH_ALEN, cur_addr->dmi_addr)>>26;
 
-                       /* do some messy swapping to put the bit in the right spot */
-                       multicast_table[invert5[position&0x1F]&0x1] |=
-                               (1<<invert5[(position>>1)&0x1F]);
+                       multicast_table[position>>5] |= 1 << (position&0x1f);
                }
 
                /* be sure I get rid of flags I might have set */
@@ -1496,6 +1480,8 @@ static void smc911x_set_multicast_list(struct net_device *dev)
 static int
 smc911x_open(struct net_device *dev)
 {
+       struct smc911x_local *lp = netdev_priv(dev);
+
        DBG(SMC_DEBUG_FUNC, "%s: --> %s\n", dev->name, __FUNCTION__);
 
        /*
@@ -1512,7 +1498,7 @@ smc911x_open(struct net_device *dev)
        smc911x_reset(dev);
 
        /* Configure the PHY, initialize the link state */
-       smc911x_phy_configure(dev);
+       smc911x_phy_configure(&lp->phy_configure);
 
        /* Turn on Tx + Rx */
        smc911x_enable(dev);
@@ -1566,19 +1552,6 @@ static int smc911x_close(struct net_device *dev)
 }
 
 /*
- * Get the current statistics.
- * This may be called with the card open or closed.
- */
-static struct net_device_stats *smc911x_query_statistics(struct net_device *dev)
-{
-       struct smc911x_local *lp = netdev_priv(dev);
-       DBG(SMC_DEBUG_FUNC, "%s: --> %s\n", dev->name, __FUNCTION__);
-
-
-       return &lp->stats;
-}
-
-/*
  * Ethtool support
  */
 static int
@@ -1654,7 +1627,7 @@ smc911x_ethtool_getdrvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
 {
        strncpy(info->driver, CARDNAME, sizeof(info->driver));
        strncpy(info->version, version, sizeof(info->version));
-       strncpy(info->bus_info, dev->class_dev.dev->bus_id, sizeof(info->bus_info));
+       strncpy(info->bus_info, dev->dev.parent->bus_id, sizeof(info->bus_info));
 }
 
 static int smc911x_ethtool_nwayreset(struct net_device *dev)
@@ -1822,7 +1795,7 @@ static int smc911x_ethtool_geteeprom_len(struct net_device *dev)
         return SMC911X_EEPROM_LEN;
 }
 
-static struct ethtool_ops smc911x_ethtool_ops = {
+static const struct ethtool_ops smc911x_ethtool_ops = {
        .get_settings    = smc911x_ethtool_getsettings,
        .set_settings    = smc911x_ethtool_setsettings,
        .get_drvinfo     = smc911x_ethtool_getdrvinfo,
@@ -2054,14 +2027,13 @@ static int __init smc911x_probe(struct net_device *dev, unsigned long ioaddr)
        dev->hard_start_xmit = smc911x_hard_start_xmit;
        dev->tx_timeout = smc911x_timeout;
        dev->watchdog_timeo = msecs_to_jiffies(watchdog);
-       dev->get_stats = smc911x_query_statistics;
        dev->set_multicast_list = smc911x_set_multicast_list;
        dev->ethtool_ops = &smc911x_ethtool_ops;
 #ifdef CONFIG_NET_POLL_CONTROLLER
        dev->poll_controller = smc911x_poll_controller;
 #endif
 
-       INIT_WORK(&lp->phy_configure, smc911x_phy_configure, dev);
+       INIT_WORK(&lp->phy_configure, smc911x_phy_configure);
        lp->mii.phy_id_mask = 0x1f;
        lp->mii.reg_num_mask = 0x1f;
        lp->mii.force_media = 0;
@@ -2081,12 +2053,11 @@ static int __init smc911x_probe(struct net_device *dev, unsigned long ioaddr)
        lp->ctl_rspeed = 100;
 
        /* Grab the IRQ */
-       retval = request_irq(dev->irq, &smc911x_interrupt, SA_SHIRQ, dev->name, dev);
+       retval = request_irq(dev->irq, &smc911x_interrupt,
+                       IRQF_SHARED | SMC_IRQ_SENSE, dev->name, dev);
        if (retval)
                goto err_out;
 
-       set_irq_type(dev->irq, IRQT_FALLING);
-
 #ifdef SMC_USE_DMA
        lp->rxdma = SMC_DMA_REQUEST(dev, smc911x_rx_dma_irq);
        lp->txdma = SMC_DMA_REQUEST(dev, smc911x_tx_dma_irq);
@@ -2155,6 +2126,7 @@ static int smc911x_drv_probe(struct platform_device *pdev)
 {
        struct net_device *ndev;
        struct resource *res;
+       struct smc911x_local *lp;
        unsigned int *addr;
        int ret;
 
@@ -2179,11 +2151,12 @@ static int smc911x_drv_probe(struct platform_device *pdev)
                ret = -ENOMEM;
                goto release_1;
        }
-       SET_MODULE_OWNER(ndev);
        SET_NETDEV_DEV(ndev, &pdev->dev);
 
        ndev->dma = (unsigned char)-1;
        ndev->irq = platform_get_irq(pdev, 0);
+       lp = netdev_priv(ndev);
+       lp->netdev = ndev;
 
        addr = ioremap(res->start, SMC911X_IO_EXTENT);
        if (!addr) {
@@ -2205,7 +2178,6 @@ out:
        }
 #ifdef SMC_USE_DMA
        else {
-               struct smc911x_local *lp = netdev_priv(ndev);
                lp->physaddr = res->start;
                lp->dev = &pdev->dev;
        }
@@ -2276,7 +2248,7 @@ static int smc911x_drv_resume(struct platform_device *dev)
                        smc911x_reset(ndev);
                        smc911x_enable(ndev);
                        if (lp->phy_type != 0)
-                               smc911x_phy_configure(ndev);
+                               smc911x_phy_configure(&lp->phy_configure);
                        netif_device_attach(ndev);
                }
        }