linux-stable.git/net/irda, branch linux-2.6.36.y

irda: Fix heap memory corruption in iriap.c

2010-12-09T21:31:56+00:00

commit 37f9fc452d138dfc4da2ee1ce5ae85094efc3606 upstream.

While parsing the GetValuebyClass command frame, we could potentially write
passed the skb->data pointer.

Reported-by: Ilja Van Sprundel 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

irda: Fix parameter extraction stack overflow

2010-12-09T21:31:56+00:00

commit efc463eb508798da4243625b08c7396462cabf9f upstream.

Reported-by: Ilja Van Sprundel 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

irda: off by one

2010-09-07T20:57:22+00:00

This is an off by one.  We would go past the end when we NUL terminate
the "value" string at end of the function.  The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().

CC: stable@kernel.org
Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

irda: Correctly clean up self->ias_obj on irda_bind() failure.

2010-08-31T01:37:56+00:00

If irda_open_tsap() fails, the irda_bind() code tries to destroy
the ->ias_obj object by hand, but does so wrongly.

In particular, it fails to a) release the hashbin attached to the
object and b) reset the self->ias_obj pointer to NULL.

Fix both problems by using irias_delete_object() and explicitly
setting self->ias_obj to NULL, just as irda_release() does.

Reported-by: Tavis Ormandy 
Signed-off-by: David S. Miller

irda: fix a race in irlan_eth_xmit()

2010-08-19T07:41:52+00:00

After skb is queued, its illegal to dereference it.

Cache skb->len into a temporary variable.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

ppp: make channel_ops const

2010-08-05T04:53:17+00:00

The PPP channel ops structure should be const.
Cleanup the declarations to use standard C99 format.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

net/irda: Remove unnecessary casts of private_data

2010-07-13T04:13:37+00:00

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

irttp: Print device parameters and statistics as unsigned

2010-06-13T01:18:33+00:00

Device statistics have type unsigned long and several of the
device-specific parameters printed here have type __u32.

Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller

net: Remove unnecessary returns from void function()s

2010-05-18T06:23:14+00:00

This patch removes from net/ (but not any netfilter files)
all the unnecessary return; statements that precede the
last closing brace of void functions.

It does not remove the returns that are immediately
preceded by a label as gcc doesn't like that.

Done via:
$ grep -rP --include=*.[ch] -l "return;\n}" net/ | \
  xargs perl -i -e 'local $/ ; while (<>) { s/\n[ \t\n]+return;\n}/\n}/g; print; }'

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

net: sk_sleep() helper

2010-04-20T23:37:13+00:00

Define a new function to return the waitqueue of a "struct sock".

static inline wait_queue_head_t *sk_sleep(struct sock *sk)
{
	return sk->sk_sleep;
}

Change all read occurrences of sk_sleep by a call to this function.

Needed for a future RCU conversion. sk_sleep wont be a field directly
available.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller