Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
  ipv4: dont create routes on down devices
  epic100: hamachi: yellowfin: Fix skb allocation size
  sundance: Fix oopses with corrupted skb_shared_info
  Revert "ipv4: Allow configuring subnets as local addresses"
  USB: mcs7830: return negative if auto negotiate fails
  irda: prevent integer underflow in IRLMP_ENUMDEVICES
  tcp: fix listening_get_next()
  atl1c: Do not use legacy PCI power management
  mac80211: fix mesh forwarding
  MAINTAINERS: email address change
  net: Fix range checks in tcf_valid_offset().
  net_sched: sch_sfq: fix allot handling
  hostap: remove netif_stop_queue from init
  mac80211/rt2x00: add ieee80211_tx_status_ni()
  typhoon: memory corruption in typhoon_get_drvinfo()
  net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant
  net_sched: always clone skbs
  ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.
  netlink: fix gcc -Wconversion compilation warning
  asix: add USB ID for Logitec LAN-GTJ U2A
  ...

1 files changed, 11 insertions, 7 deletions

diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index a6de3059746..c9890e25cd4 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2280,6 +2280,16 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 
         switch (optname) {
         case IRLMP_ENUMDEVICES:
+
+                /* Offset to first device entry */
+                offset = sizeof(struct irda_device_list) -
+                        sizeof(struct irda_device_info);
+
+                if (len < offset) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
                 /* Ask lmp for the current discovery log */
                 discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
                                                     self->nslots);
@@ -2290,15 +2300,9 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
                 }
 
                 /* Write total list length back to client */
-                if (copy_to_user(optval, &list,
-                                 sizeof(struct irda_device_list) -
-                                 sizeof(struct irda_device_info)))
+                if (copy_to_user(optval, &list, offset))
                         err = -EFAULT;
 
-                /* Offset to first device entry */
-                offset = sizeof(struct irda_device_list) -
-                        sizeof(struct irda_device_info);
-
                 /* Copy the list itself - watch for overflow */
                 if (list.len > 2048) {
                         err = -EINVAL;