Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
Staging: vt6655: fix buffer overflow
Revert: "Staging: batman-adv: Adding netfilter-bridge hooks"
+10
-22
-13
drivers/staging/batman-adv/hard-interface.c
-13
drivers/staging/batman-adv/hard-interface.c
···
30
30
#include "hash.h"
31
31
32
32
#include <linux/if_arp.h>
33
-
#include <linux/netfilter_bridge.h>
34
33
35
34
#define MIN(x, y) ((x) < (y) ? (x) : (y))
36
35
···
430
431
return NOTIFY_DONE;
431
432
}
432
433
433
-
static int batman_skb_recv_finish(struct sk_buff *skb)
434
-
{
435
-
return NF_ACCEPT;
436
-
}
437
-
438
434
/* receive a packet with the batman ethertype coming on a hard
439
435
* interface */
440
436
int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
···
449
455
450
456
if (atomic_read(&module_state) != MODULE_ACTIVE)
451
457
goto err_free;
452
-
453
-
/* if netfilter/ebtables wants to block incoming batman
454
-
* packets then give them a chance to do so here */
455
-
ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL,
456
-
batman_skb_recv_finish);
457
-
if (ret != 1)
458
-
goto err_out;
459
458
460
459
/* packet should hold at least type and version */
461
460
if (unlikely(skb_headlen(skb) < 2))
+2
-6
drivers/staging/batman-adv/send.c
+2
-6
drivers/staging/batman-adv/send.c
···
29
29
#include "vis.h"
30
30
#include "aggregation.h"
31
31
32
-
#include <linux/netfilter_bridge.h>
33
32
34
33
static void send_outstanding_bcast_packet(struct work_struct *work);
35
34
···
91
92
92
93
/* dev_queue_xmit() returns a negative result on error. However on
93
94
* congestion and traffic shaping, it drops and returns NET_XMIT_DROP
94
-
* (which is > 0). This will not be treated as an error.
95
-
* Also, if netfilter/ebtables wants to block outgoing batman
96
-
* packets then giving them a chance to do so here */
95
+
* (which is > 0). This will not be treated as an error. */
97
96
98
-
return NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
99
-
dev_queue_xmit);
97
+
return dev_queue_xmit(skb);
100
98
send_skb_err:
101
99
kfree_skb(skb);
102
100
return NET_XMIT_DROP;
+8
-3
drivers/staging/vt6655/wpactl.c
+8
-3
drivers/staging/vt6655/wpactl.c
···
766
766
DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);
767
767
768
768
769
-
if (param->u.wpa_associate.wpa_ie &&
770
-
copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
771
-
return -EINVAL;
769
+
if (param->u.wpa_associate.wpa_ie_len) {
770
+
if (!param->u.wpa_associate.wpa_ie)
771
+
return -EINVAL;
772
+
if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))
773
+
return -EINVAL;
774
+
if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
775
+
return -EFAULT;
776
+
}
772
777
773
778
if (param->u.wpa_associate.mode == 1)
774
779
pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;