3 files changed, 16 insertions, 4 deletions

diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 18dd8aacbe8..831ddce1467 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -46,6 +46,9 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 /* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
 #define IF_WRITEBUF 264
 
+/* interrupt pipe message size according to ibid. ch. 2.2 */
+#define IP_MSGSIZE 3
+
 /* Values for the Gigaset 307x */
 #define USB_GIGA_VENDOR_ID      0x0681
 #define USB_3070_PRODUCT_ID     0x0001
@@ -110,7 +113,7 @@ struct bas_cardstate {
         unsigned char           *rcvbuf;        /* AT reply receive buffer */
 
         struct urb              *urb_int_in;    /* URB for interrupt pipe */
-        unsigned char           int_in_buf[3];
+        unsigned char           *int_in_buf;
 
         spinlock_t              lock;           /* locks all following */
         int                     basstate;       /* bitmap (BS_*) */
@@ -657,7 +660,7 @@ static void read_int_callback(struct urb *urb)
         }
 
         /* drop incomplete packets even if the missing bytes wouldn't matter */
-        if (unlikely(urb->actual_length < 3)) {
+        if (unlikely(urb->actual_length < IP_MSGSIZE)) {
                 dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
                          urb->actual_length);
                 goto resubmit;
@@ -2127,6 +2130,7 @@ static void gigaset_reinitbcshw(struct bc_state *bcs)
 static void gigaset_freecshw(struct cardstate *cs)
 {
         /* timers, URBs and rcvbuf are disposed of in disconnect */
+        kfree(cs->hw.bas->int_in_buf);
         kfree(cs->hw.bas);
         cs->hw.bas = NULL;
 }
@@ -2140,6 +2144,12 @@ static int gigaset_initcshw(struct cardstate *cs)
                 pr_err("out of memory\n");
                 return 0;
         }
+        ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
+        if (!ucs->int_in_buf) {
+                kfree(ucs);
+                pr_err("out of memory\n");
+                return 0;
+        }
 
         ucs->urb_cmd_in = NULL;
         ucs->urb_cmd_out = NULL;
@@ -2292,7 +2302,7 @@ static int gigaset_probe(struct usb_interface *interface,
         usb_fill_int_urb(ucs->urb_int_in, udev,
                          usb_rcvintpipe(udev,
                                         (endpoint->bEndpointAddress) & 0x0f),
-                         ucs->int_in_buf, 3, read_int_callback, cs,
+                         ucs->int_in_buf, IP_MSGSIZE, read_int_callback, cs,
                          endpoint->bInterval);
         if ((rc = usb_submit_urb(ucs->urb_int_in, GFP_KERNEL)) != 0) {
                 dev_err(cs->dev, "could not submit interrupt URB: %s\n",
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 595ba8eb4a0..0b28141e43b 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -4599,6 +4599,7 @@ init_e1_port(struct hfc_multi *hc, struct hm_map *m)
                         printk(KERN_ERR "%s: no memory for coeffs\n",
                             __func__);
                         ret = -ENOMEM;
+                        kfree(bch);
                         goto free_chan;
                 }
                 bch->nr = ch;
@@ -4767,6 +4768,7 @@ init_multi_port(struct hfc_multi *hc, int pt)
                         printk(KERN_ERR "%s: no memory for coeffs\n",
                             __func__);
                         ret = -ENOMEM;
+                        kfree(bch);
                         goto free_chan;
                 }
                 bch->nr = ch + 1;
diff --git a/drivers/isdn/sc/shmem.c b/drivers/isdn/sc/shmem.c
index 712220cef13..7f16d75d2d8 100644
--- a/drivers/isdn/sc/shmem.c
+++ b/drivers/isdn/sc/shmem.c
@@ -54,7 +54,7 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
         spin_unlock_irqrestore(&sc_adapter[card]->lock, flags);
         pr_debug("%s: set page to %#x\n",sc_adapter[card]->devicename,
                 ((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE)>>14)|0x80);
-        pr_debug("%s: copying %d bytes from %#lx to %#lx\n",
+        pr_debug("%s: copying %zu bytes from %#lx to %#lx\n",
                 sc_adapter[card]->devicename, n,
                 (unsigned long) src,
                 sc_adapter[card]->rambase + ((unsigned long) dest %0x4000));