linux-stable.git/drivers/staging/vt6655, branch v3.3

staging: vt6655: integer overflows in private_ioctl()

2011-11-30T10:29:40+00:00

There are two potential integer overflows in private_ioctl() if
userspace passes in a large sList.uItem / sNodeList.uItem.  The
subsequent call to kmalloc() would allocate a small buffer, leading
to a memory corruption.

Reported-by: Dan Rosenberg 
Signed-off-by: Xi Wang 
Signed-off-by: Greg Kroah-Hartman

staging:vt6656: iwctl.c: Removed unneeded function

2011-11-30T10:25:50+00:00

Removed the function iwctl_giwnwid, that just return a error code.

Changes v1 to v2:
	Removed same functions of vt6655 and vt6656.

Signed-off-by: Marcos Paulo de Souza 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2011-10-26T13:39:02+00:00

* 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1519 commits)
  staging: et131x: Remove redundant check and return statement
  staging: et131x: Mainly whitespace changes to appease checkpatch
  staging: et131x: Remove last of the forward declarations
  staging: et131x: Remove even more forward declarations
  staging: et131x: Remove yet more forward declarations
  staging: et131x: Remove more forward declarations
  staging: et131x: Remove forward declaration of et131x_adapter_setup
  staging: et131x: Remove some forward declarations
  staging: et131x: Remove unused rx_ring.recv_packet_pool
  staging: et131x: Remove call to find pci pm capability
  staging: et131x: Remove redundant et131x_reset_recv() call
  staging: et131x: Remove unused rx_ring.recv_buffer_pool
  Staging: bcm: Fix three initialization errors in InterfaceDld.c
  Staging: bcm: Fix coding style issues in InterfaceDld.c
  staging:iio:dac: Add AD5360 driver
  staging:iio:trigger:bfin-timer: Fix compile error
  Staging: vt6655: add some range checks before memcpy()
  Staging: vt6655: whitespace fixes to iotcl.c
  Staging: vt6656: add some range checks before memcpy()
  Staging: vt6656: whitespace cleanups in ioctl.c
  ...

Fix up conflicts in:
 - drivers/{Kconfig,Makefile}, drivers/staging/{Kconfig,Makefile}:
	vg driver movement
 - drivers/staging/brcm80211/brcmfmac/{dhd_linux.c,mac80211_if.c}:
	driver removal vs now stale changes
 - drivers/staging/rtl8192e/r8192E_core.c:
	driver removal vs now stale changes
 - drivers/staging/et131x/et131*:
	driver consolidation into one file, tried to do fixups

Staging: vt6655: add some range checks before memcpy()

2011-10-23T08:13:20+00:00

There were no range checks in the original code so the user could
write past the end of the array.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: vt6655: whitespace fixes to iotcl.c

2011-10-23T08:13:20+00:00

The indents didn't line up at all in the original code.  I also fixed
a bunch of other white issues as I went along.  I changed the comment
style and removed some commented out code.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: vt6655: memory corruption in check in wpa_set_wpadev()

2011-10-19T20:42:48+00:00

The original code left it up to the user to decide how much data to
copy, but that doesn't work with a fixed size array.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: vt6655-6: potential info leak in private_ioctl()

2011-09-27T00:43:44+00:00

Smatch has a new check for Rosenberg type information leaks where
structs are copied to the user with uninitialized stack data in them.

In this path, the .uLinkRate member doesn't get initialized so I've
set it to zero.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

staging: vt6655: simplify MAC printing by using %pM

2011-08-23T21:36:17+00:00

Signed-off-by: Andy Shevchenko 
Signed-off-by: Greg Kroah-Hartman

staging: vt6655: Fixed all the indents and other errors in IEEE11h.c

2011-08-23T20:27:28+00:00

Signed-off-by: Toon Schoenmakers 
Signed-off-by: Greg Kroah-Hartman

net: remove use of ndo_set_multicast_list in drivers

2011-08-18T03:22:03+00:00

replace it by ndo_set_rx_mode

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller