summaryrefslogtreecommitdiff
path: root/drivers/isdn
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2010-08-09 21:05:52 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2010-08-09 21:05:52 -0700
commitf6cec0ae58c17522a7bc4e2f39dae19f199ab534 (patch)
tree496cf6f53b0c75d9ae57bd0e411c5d2f6cea5cbb /drivers/isdn
parent0fcf12d510b6d1b1b090a090c62009310eca4be4 (diff)
parentc4e9b56e24422e71424b24eee27c2b134a191d7b (diff)
downloadlinux-3.10-f6cec0ae58c17522a7bc4e2f39dae19f199ab534.tar.gz
linux-3.10-f6cec0ae58c17522a7bc4e2f39dae19f199ab534.tar.bz2
linux-3.10-f6cec0ae58c17522a7bc4e2f39dae19f199ab534.zip
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (59 commits) igbvf.txt: Add igbvf Documentation igb.txt: Add igb documentation e100/e1000*/igb*/ixgb*: Add missing read memory barrier ixgbe: fix build error with FCOE_CONFIG without DCB_CONFIG netxen: protect tx timeout recovery by rtnl lock isdn: gigaset: use after free isdn: gigaset: add missing unlock solos-pci: Fix race condition in tasklet RX handling pkt_sched: Fix sch_sfq vs tcf_bind_filter oops net: disable preemption before call smp_processor_id() tcp: no md5sig option size check bug iwlwifi: fix locking assertions iwlwifi: fix TX tracer isdn: fix information leak net: Fix napi_gro_frags vs netpoll path usbnet: remove noisy and hardly useful printk rtl8180: avoid potential NULL deref in rtl8180_beacon_work ath9k: Remove myself from the MAINTAINERS list libertas: scan before assocation if no BSSID was given libertas: fix association with some APs by using extended rates ...
Diffstat (limited to 'drivers/isdn')
-rw-r--r--drivers/isdn/gigaset/bas-gigaset.c6
-rw-r--r--drivers/isdn/gigaset/capi.c1
-rw-r--r--drivers/isdn/sc/ioctl.c10
3 files changed, 10 insertions, 7 deletions
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 0ded3640b92..707d9c94cf9 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
* The next command will reopen the AT channel automatically.
*/
if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
- kfree(cb);
rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
if (cb->wake_tasklet)
tasklet_schedule(cb->wake_tasklet);
- return rc < 0 ? rc : cb->len;
+ if (!rc)
+ rc = cb->len;
+ kfree(cb);
+ return rc;
}
spin_lock_irqsave(&cs->cmdlock, flags);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index e5ea344a551..bcc174e4f3b 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -1052,6 +1052,7 @@ static inline void remove_appl_from_channel(struct bc_state *bcs,
do {
if (bcap->bcnext == ap) {
bcap->bcnext = bcap->bcnext->bcnext;
+ spin_unlock_irqrestore(&bcs->aplock, flags);
return;
}
bcap = bcap->bcnext;
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 43c5dc3516e..4cfdbe08ffd 100644
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data)
pr_debug("%s: SCIOGETSPID: ioctl received\n",
sc_adapter[card]->devicename);
- spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
+ spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
if (!spid) {
kfree(rcvmsg);
return -ENOMEM;
@@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data)
kfree(rcvmsg);
return status;
}
- strcpy(spid, rcvmsg->msg_data.byte_array);
+ strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE);
/*
* Package the switch type and send to user space
@@ -266,12 +266,12 @@ int sc_ioctl(int card, scs_ioctl *data)
return status;
}
- dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL);
+ dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL);
if (!dn) {
kfree(rcvmsg);
return -ENOMEM;
}
- strcpy(dn, rcvmsg->msg_data.byte_array);
+ strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE);
kfree(rcvmsg);
/*
@@ -337,7 +337,7 @@ int sc_ioctl(int card, scs_ioctl *data)
pr_debug("%s: SCIOSTAT: ioctl received\n",
sc_adapter[card]->devicename);
- bi = kmalloc (sizeof(boardInfo), GFP_KERNEL);
+ bi = kzalloc(sizeof(boardInfo), GFP_KERNEL);
if (!bi) {
kfree(rcvmsg);
return -ENOMEM;