+16 -18

drivers/net/bnx2.c

reviewed

··· 54 54 55 55 #define DRV_MODULE_NAME "bnx2" 56 56 #define PFX DRV_MODULE_NAME ": " 57 57 - #define DRV_MODULE_VERSION "1.5.6" 58 58 - #define DRV_MODULE_RELDATE "March 28, 2007" 57 57 + #define DRV_MODULE_VERSION "1.5.7" 58 58 + #define DRV_MODULE_RELDATE "March 29, 2007" 59 59 60 60 #define RUN_AT(x) (jiffies + (x)) 61 61 ··· 3099 3099 3100 3100 if ((align_start = (offset32 & 3))) { 3101 3101 offset32 &= ~3; 3102 3102 - len32 += (4 - align_start); 3102 3102 + len32 += align_start; 3103 3103 + if (len32 < 4) 3104 3104 + len32 = 4; 3103 3105 if ((rc = bnx2_nvram_read(bp, offset32, start, 4))) 3104 3106 return rc; 3105 3107 } 3106 3108 3107 3109 if (len32 & 3) { 3108 3108 - if ((len32 > 4) || !align_start) { 3109 3109 - align_end = 4 - (len32 & 3); 3110 3110 - len32 += align_end; 3111 3111 - if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4, 3112 3112 - end, 4))) { 3113 3113 - return rc; 3114 3114 - } 3115 3115 - } 3110 3110 + align_end = 4 - (len32 & 3); 3111 3111 + len32 += align_end; 3112 3112 + if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4, end, 4))) 3113 3113 + return rc; 3116 3114 } 3117 3115 3118 3116 if (align_start || align_end) { ··· 3185 3187 if ((rc = bnx2_enable_nvram_write(bp)) != 0) 3186 3188 goto nvram_write_end; 3187 3189 3188 3188 - /* Erase the page */ 3189 3189 - if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0) 3190 3190 - goto nvram_write_end; 3191 3191 - 3192 3192 - /* Re-enable the write again for the actual write */ 3193 3193 - bnx2_enable_nvram_write(bp); 3194 3194 - 3195 3190 /* Loop to write back the buffer data from page_start to 3196 3191 * data_start */ 3197 3192 i = 0; 3198 3193 if (bp->flash_info->buffered == 0) { 3194 3194 + /* Erase the page */ 3195 3195 + if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0) 3196 3196 + goto nvram_write_end; 3197 3197 + 3198 3198 + /* Re-enable the write again for the actual write */ 3199 3199 + bnx2_enable_nvram_write(bp); 3200 3200 + 3199 3201 for (addr = page_start; addr < data_start; 3200 3202 addr += 4, i += 4) { 3201 3203

+1 -1

net/core/fib_rules.c

reviewed

··· 143 143 } 144 144 } 145 145 146 146 - err = -ENETUNREACH; 146 146 + err = -ESRCH; 147 147 out: 148 148 rcu_read_unlock(); 149 149

+3

net/ipv4/tcp_output.c

reviewed

··· 1607 1607 */ 1608 1608 if (window <= free_space - mss || window > free_space) 1609 1609 window = (free_space/mss)*mss; 1610 1610 + else if (mss == full_space && 1611 1611 + free_space > window + full_space/2) 1612 1612 + window = free_space; 1610 1613 } 1611 1614 1612 1615 return window;

+2 -2

net/ipv6/raw.c

reviewed

··· 687 687 int err; 688 688 689 689 /* Rough check on arithmetic overflow, 690 690 - better check is made in ip6_build_xmit 690 690 + better check is made in ip6_append_data(). 691 691 */ 692 692 - if (len < 0) 692 692 + if (len > INT_MAX) 693 693 return -EMSGSIZE; 694 694 695 695 /* Mirror BSD error message compatibility */

+1 -1

net/ipv6/udp.c

reviewed

··· 615 615 return udp_sendmsg(iocb, sk, msg, len); 616 616 617 617 /* Rough check on arithmetic overflow, 618 618 - better check is made in ip6_build_xmit 618 618 + better check is made in ip6_append_data(). 619 619 */ 620 620 if (len > INT_MAX - sizeof(struct udphdr)) 621 621 return -EMSGSIZE;

+1

net/sched/cls_basic.c

reviewed

··· 109 109 list_del(&f->link); 110 110 basic_delete_filter(tp, f); 111 111 } 112 112 + kfree(head); 112 113 } 113 114 114 115 static int basic_delete(struct tcf_proto *tp, unsigned long arg)