diff options
| -rw-r--r-- | drivers/atm/he.c | 14 | ||||
| -rw-r--r-- | drivers/isdn/hardware/mISDN/Kconfig | 1 | ||||
| -rw-r--r-- | drivers/isdn/i4l/Kconfig | 3 | ||||
| -rw-r--r-- | net/ax25/af_ax25.c | 19 | ||||
| -rw-r--r-- | net/bridge/br_if.c | 1 | ||||
| -rw-r--r-- | net/socket.c | 7 |
6 files changed, 26 insertions, 19 deletions
diff --git a/drivers/atm/he.c b/drivers/atm/he.c index 29e66d603d3..70667033a56 100644 --- a/drivers/atm/he.c +++ b/drivers/atm/he.c @@ -921,9 +921,9 @@ out_free_rbpq_base: he_dev->rbrq_phys); i = CONFIG_RBPL_SIZE; out_free_rbpl_virt: - while (--i) - pci_pool_free(he_dev->rbps_pool, he_dev->rbpl_virt[i].virt, - he_dev->rbps_base[i].phys); + while (i--) + pci_pool_free(he_dev->rbpl_pool, he_dev->rbpl_virt[i].virt, + he_dev->rbpl_base[i].phys); kfree(he_dev->rbpl_virt); out_free_rbpl_base: @@ -933,11 +933,11 @@ out_free_rbpl_base: out_destroy_rbpl_pool: pci_pool_destroy(he_dev->rbpl_pool); - i = CONFIG_RBPL_SIZE; + i = CONFIG_RBPS_SIZE; out_free_rbps_virt: - while (--i) - pci_pool_free(he_dev->rbpl_pool, he_dev->rbps_virt[i].virt, - he_dev->rbpl_base[i].phys); + while (i--) + pci_pool_free(he_dev->rbps_pool, he_dev->rbps_virt[i].virt, + he_dev->rbps_base[i].phys); kfree(he_dev->rbps_virt); out_free_rbps_base: diff --git a/drivers/isdn/hardware/mISDN/Kconfig b/drivers/isdn/hardware/mISDN/Kconfig index bde55d7287f..eadc1cd34a2 100644 --- a/drivers/isdn/hardware/mISDN/Kconfig +++ b/drivers/isdn/hardware/mISDN/Kconfig @@ -78,6 +78,7 @@ config MISDN_NETJET depends on PCI select MISDN_IPAC select ISDN_HDLC + select ISDN_I4L help Enable support for Traverse Technologies NETJet PCI cards. diff --git a/drivers/isdn/i4l/Kconfig b/drivers/isdn/i4l/Kconfig index dd744ffd240..07c4e49f9e7 100644 --- a/drivers/isdn/i4l/Kconfig +++ b/drivers/isdn/i4l/Kconfig @@ -141,8 +141,7 @@ endmenu endif config ISDN_HDLC - tristate - depends on HISAX_ST5481 + tristate select CRC_CCITT select BITREVERSE diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index fbcac76fdc0..4102de1022e 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -641,15 +641,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, case SO_BINDTODEVICE: if (optlen > IFNAMSIZ) - optlen=IFNAMSIZ; - if (copy_from_user(devname, optval, optlen)) { - res = -EFAULT; - break; - } + optlen = IFNAMSIZ; - dev = dev_get_by_name(&init_net, devname); - if (dev == NULL) { - res = -ENODEV; + if (copy_from_user(devname, optval, optlen)) { + res = -EFAULT; break; } @@ -657,12 +652,18 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, (sock->state != SS_UNCONNECTED || sk->sk_state == TCP_LISTEN)) { res = -EADDRNOTAVAIL; - dev_put(dev); + break; + } + + dev = dev_get_by_name(&init_net, devname); + if (!dev) { + res = -ENODEV; break; } ax25->ax25_dev = ax25_dev_ax25dev(dev); ax25_fillin_cb(ax25, ax25->ax25_dev); + dev_put(dev); break; default: diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index 142ebac1417..b1b3b0fbf41 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -432,6 +432,7 @@ err2: br_fdb_delete_by_port(br, p, 1); err1: kobject_put(&p->kobj); + p = NULL; /* kobject_put frees */ err0: dev_set_promiscuity(dev, -1); put_back: diff --git a/net/socket.c b/net/socket.c index 49917a1cac7..41e8847508a 100644 --- a/net/socket.c +++ b/net/socket.c @@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) unsigned long a[6]; unsigned long a0, a1; int err; + unsigned int len; if (call < 1 || call > SYS_ACCEPT4) return -EINVAL; + len = nargs[call]; + if (len > sizeof(a)) + return -EINVAL; + /* copy_from_user should be SMP safe. */ - if (copy_from_user(a, args, nargs[call])) + if (copy_from_user(a, args, len)) return -EFAULT; audit_socketcall(nargs[call] / sizeof(unsigned long), a); |