2 more patches.

diff --git a/review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch b/review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch
new file mode 100644 (file)
index 0000000..0f848b2
--- /dev/null
+++ b/review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch
@@ -0,0 +1,42 @@
+From a7be18d436f0c7007794965e5af29fa1ffff1e05 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@redhat.com>
+Date: Mon, 13 Oct 2008 10:45:17 +0100
+Subject: applicom: Fix an unchecked user ioctl range and an error return
+
+From: Alan Cox <alan@redhat.com>
+
+commit a7be18d436f0c7007794965e5af29fa1ffff1e05 upstream.
+
+Closes bug #11408 by checking the card index range for command 0
+Fixes the ioctl to return ENOTTY which is correct for unknown ioctls
+
+Signed-off-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/applicom.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/applicom.c
++++ b/drivers/char/applicom.c
+@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode,
+       
+       IndexCard = adgl->num_card-1;
+        
+-      if(cmd != 0 && cmd != 6 &&
+-         ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
++      if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
+               static int warncount = 10;
+               if (warncount) {
+                       printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
+@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode,
+               }
+               break;
+       default:
+-              printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ;
+-              ret = -EINVAL;
++              ret = -ENOTTY;
+               break;
+       }
+       Dummy = readb(apbs[IndexCard].RamIO + VERS);

diff --git a/review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch b/review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch
new file mode 100644 (file)
index 0000000..004a343
--- /dev/null
+++ b/review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch
@@ -0,0 +1,37 @@
+From 7c2500f17d65092d93345f3996cf82ebca17e9ff Mon Sep 17 00:00:00 2001
+From: Wim Van Sebroeck <wim@iguana.be>
+Date: Wed, 15 Oct 2008 08:53:06 +0000
+Subject: [WATCHDOG] ib700wdt.c - fix buffer_underflow bug
+
+From: Wim Van Sebroeck <wim@iguana.be>
+
+commit 7c2500f17d65092d93345f3996cf82ebca17e9ff upstream.
+
+This fixes Bug 11399:
+if ibwdt_set_heartbeat(int t) is called with value 30 then
+the check "if ((t < 0) || (t > 30))" in ibwdt_set_heartbeat
+is not going to fail because t == 30, but in the loop, the
+check wd_times[i] > t is never going to be true because
+none of the wd_times are greater than the value of t (i.e. 30).
+So we are exiting the loop with i == -1 and therefore setting
+wd_margin to -1 which is wrong.
+
+Reported-by: Zvonimir Rakamaric <zrakamar@cs.ubc.ca>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/ib700wdt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/ib700wdt.c
++++ b/drivers/watchdog/ib700wdt.c
+@@ -154,7 +154,7 @@ static int ibwdt_set_heartbeat(int t)
+               return -EINVAL;
+ 
+       for (i = 0x0F; i > -1; i--)
+-              if (wd_times[i] > t)
++              if (wd_times[i] >= t)
+                       break;
+       wd_margin = i;
+       return 0;

diff --git a/review-2.6.27/series b/review-2.6.27/series
index c48a8c8f5952cd8058043fe6aba626c6fa08d204..7ce4b7da1cdec0ccdc3c1ac200d095dc1ed1db8e 100644 (file)
--- a/review-2.6.27/series
+++ b/review-2.6.27/series
@@ -82,3 +82,5 @@ cifs-fix-a-regression-in-cifs-umount-codepath.patch
 pnp-make-the-resource-type-an-unsigned-long.patch
 powerpc-use-cpu_thread_in_core-in-smp_init-for-of_spin_map.patch
 xfs-fix-hang-after-disallowed-rename-across-directory-quota-domains.patch
+applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch
+ib700wdt.c-fix-buffer_underflow-bug.patch