Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1958 commits)
  net: pack skb_shared_info more efficiently
  net_sched: red: split red_parms into parms and vars
  net_sched: sfq: extend limits
  cnic: Improve error recovery on bnx2x devices
  cnic: Re-init dev->stats_addr after chip reset
  net_sched: Bug in netem reordering
  bna: fix sparse warnings/errors
  bna: make ethtool_ops and strings const
  xgmac: cleanups
  net: make ethtool_ops const
  vmxnet3" make ethtool ops const
  xen-netback: make ops structs const
  virtio_net: Pass gfp flags when allocating rx buffers.
  ixgbe: FCoE: Add support for ndo_get_fcoe_hbainfo() call
  netdev: FCoE: Add new ndo_get_fcoe_hbainfo() call
  igb: reset PHY after recovering from PHY power down
  igb: add basic runtime PM support
  igb: Add support for byte queue limits.
  e1000: cleanup CE4100 MDIO registers access
  e1000: unmap ce4100_gbe_mdio_base_virt in e1000_remove
  ...

1 files changed, 7 insertions, 4 deletions

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 915a87ba23e1..2cf330162d7e 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -670,14 +670,17 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
         case SIOCADDRT:
                 if (copy_from_user(&nr_route, arg, sizeof(struct nr_route_struct)))
                         return -EFAULT;
-                if ((dev = nr_ax25_dev_get(nr_route.device)) == NULL)
+                if (nr_route.ndigis > AX25_MAX_DIGIS)
                         return -EINVAL;
-                if (nr_route.ndigis < 0 || nr_route.ndigis > AX25_MAX_DIGIS) {
-                        dev_put(dev);
+                if ((dev = nr_ax25_dev_get(nr_route.device)) == NULL)
                         return -EINVAL;
-                }
                 switch (nr_route.type) {
                 case NETROM_NODE:
+                        if (strnlen(nr_route.mnemonic, 7) == 7) {
+                                ret = -EINVAL;
+                                break;
+                        }
+
                         ret = nr_add_node(&nr_route.callsign,
                                 nr_route.mnemonic,
                                 &nr_route.neighbour,