From: Greg Kroah-Hartman Date: Sat, 25 Mar 2006 08:35:43 +0000 (-0800) Subject: add new 2.6.16 queued patches X-Git-Tag: v2.6.16.1~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d0843fe592919fcb01322f3bf9dc5a73b1b5176f;p=thirdparty%2Fkernel%2Fstable-queue.git add new 2.6.16 queued patches --- diff --git a/queue-2.6.16/series b/queue-2.6.16/series new file mode 100644 index 00000000000..803f59201e3 --- /dev/null +++ b/queue-2.6.16/series @@ -0,0 +1,2 @@ +tlclk-fix-handling-of-device-major.patch +usb-0079-Fix-irda-usb-use-after-use.patch diff --git a/queue-2.6.16/tlclk-fix-handling-of-device-major.patch b/queue-2.6.16/tlclk-fix-handling-of-device-major.patch new file mode 100644 index 00000000000..7fb89fc08f8 --- /dev/null +++ b/queue-2.6.16/tlclk-fix-handling-of-device-major.patch @@ -0,0 +1,40 @@ +From stable-bounces@linux.kernel.org Fri Mar 24 21:32:57 2006 +Message-Id: <200603250532.k2P5WiBr013881@shell0.pdx.osdl.net> +To: akpm@osdl.org, mgross@linux.intel.com, stable@kernel.org, + mm-commits@vger.kernel.org +From: akpm@osdl.org +Date: Fri, 24 Mar 2006 21:29:13 -0800 +Cc: +Subject: tlclk: fix handling of device major + + +From: Andrew Morton + +tlclk calls register_chrdev() and permits register_chrdev() to allocate the +major, but it promptly forgets what that major was. So if there's no hardware +present you still get "telco_clock" appearing in /proc/devices and, I assume, +an oops reading /proc/devices if tlclk was a module. + +Fix. + +Mark, I'd suggest that that we not call register_chrdev() until _after_ we've +established that the hardware is present. + +Cc: Mark Gross +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/char/tlclk.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.orig/drivers/char/tlclk.c ++++ linux-2.6.16/drivers/char/tlclk.c +@@ -767,6 +767,7 @@ static int __init tlclk_init(void) + printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major); + return ret; + } ++ tlclk_major = ret; + alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL); + if (!alarm_events) + goto out1; diff --git a/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch b/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch new file mode 100644 index 00000000000..ede77f67ac2 --- /dev/null +++ b/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch @@ -0,0 +1,44 @@ +From nobody Mon Sep 17 00:00:00 2001 +From: Eugene Teo +Date: Wed Mar 15 14:57:19 2006 -0800 +Subject: [PATCH 79/81] USB: Fix irda-usb use after use + +Don't read from free'd memory after calling netif_rx(). docopy is used as +a boolean (0 and 1) so unsigned int is sufficient. + +Coverity bug #928 + +Signed-off-by: Eugene Teo +Cc: "David S. Miller" +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + + drivers/net/irda/irda-usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.16.orig/drivers/net/irda/irda-usb.c ++++ linux-2.6.16/drivers/net/irda/irda-usb.c +@@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb + struct sk_buff *newskb; + struct sk_buff *dataskb; + struct urb *next_urb; +- int docopy; ++ unsigned int len, docopy; + + IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length); + +@@ -851,10 +851,11 @@ static void irda_usb_receive(struct urb + dataskb->dev = self->netdev; + dataskb->mac.raw = dataskb->data; + dataskb->protocol = htons(ETH_P_IRDA); ++ len = dataskb->len; + netif_rx(dataskb); + + /* Keep stats up to date */ +- self->stats.rx_bytes += dataskb->len; ++ self->stats.rx_bytes += len; + self->stats.rx_packets++; + self->netdev->last_rx = jiffies; +