diff options
| author | James Bottomley <jejb@mulgrave.il.steeleye.com> | 2006-11-22 19:06:44 +0100 |
|---|---|---|
| committer | James Bottomley <jejb@mulgrave.il.steeleye.com> | 2006-11-22 19:06:44 +0100 |
| commit | 0bd2af46839ad6262d25714a6ec0365db9d6b98f (patch) | |
| tree | dcced72d230d69fd0c5816ac6dd03ab84799a93e /drivers/isdn/pcbit | |
| parent | [SCSI] aic94xx: fix pointer to integer conversion warning (diff) | |
| parent | [PATCH] qla4xxx: bug fix: driver hardware semaphore needs to be grabbed befor... (diff) | |
| download | linux-0bd2af46839ad6262d25714a6ec0365db9d6b98f.tar.xz linux-0bd2af46839ad6262d25714a6ec0365db9d6b98f.zip | |
Merge ../scsi-rc-fixes-2.6
Diffstat (limited to 'drivers/isdn/pcbit')
| -rw-r--r-- | drivers/isdn/pcbit/drv.c | 16 | ||||
| -rw-r--r-- | drivers/isdn/pcbit/layer2.c | 1 |
2 files changed, 11 insertions, 6 deletions
diff --git a/drivers/isdn/pcbit/drv.c b/drivers/isdn/pcbit/drv.c index 94f21486bb24..6ead5e1508b7 100644 --- a/drivers/isdn/pcbit/drv.c +++ b/drivers/isdn/pcbit/drv.c @@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf, int len, int driver, int channel) if (stat_st < stat_end) { - copy_to_user(buf, statbuf + stat_st, len); + if (copy_to_user(buf, statbuf + stat_st, len)) + return -EFAULT; stat_st += len; } else { if (len > STATBUF_LEN - stat_st) { - copy_to_user(buf, statbuf + stat_st, - STATBUF_LEN - stat_st); - copy_to_user(buf, statbuf, - len - (STATBUF_LEN - stat_st)); + if (copy_to_user(buf, statbuf + stat_st, + STATBUF_LEN - stat_st)) + return -EFAULT; + if (copy_to_user(buf, statbuf, + len - (STATBUF_LEN - stat_st))) + return -EFAULT; stat_st = len - (STATBUF_LEN - stat_st); } else { - copy_to_user(buf, statbuf + stat_st, len); + if (copy_to_user(buf, statbuf + stat_st, len)) + return -EFAULT; stat_st += len; diff --git a/drivers/isdn/pcbit/layer2.c b/drivers/isdn/pcbit/layer2.c index 13e7d219d1c7..937fd2120381 100644 --- a/drivers/isdn/pcbit/layer2.c +++ b/drivers/isdn/pcbit/layer2.c @@ -311,6 +311,7 @@ pcbit_deliver(void *data) dev->read_queue = frame->next; spin_unlock_irqrestore(&dev->lock, flags); + msg = 0; SET_MSG_CPU(msg, 0); SET_MSG_PROC(msg, 0); SET_MSG_CMD(msg, frame->skb->data[2]); |