Merge branch 'for-next/dwc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

* 'for-next/dwc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (392 commits)
  usb: dwc3: ep0: fix for possible early delayed_status
  usb: dwc3: gadget: fix stream enable bit
  usb: dwc3: ep0: fix GetStatus handling (again)
  usb: dwc3: ep0: use dwc3_request for ep0 requsts instead of usb_request
  usb: dwc3: use correct hwparam register for power mgm check
  usb: dwc3: omap: move to module_platform_driver
  usb: dwc3: workaround: missing disconnect event
  usb: dwc3: workaround: missing USB3 Reset event
  usb: dwc3: workaround: U1/U2 -> U0 transiton
  usb: dwc3: gadget: return early in dwc3_cleanup_done_reqs()
  usb: dwc3: ep0: handle delayed_status again
  usb: dwc3: ep0: push ep0state into xfernotready processing
  usb: dwc3: fix sparse errors
  usb: dwc3: fix few coding style problems
  usb: dwc3: move generic dwc3 code from gadget into core
  usb: dwc3: use a helper function for operation mode setting
  usb: dwc3: ep0: don't use ep0in for transfers
  usb: dwc3: ep0: use proper endianess in SetFeature for wIndex
  usb: dwc3: core: drop DWC3_EVENT_BUFFERS_MAX
  usb: dwc3: omap: add multiple instances support to OMAP
  ...

1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 33ec9e467772..9021182c4b76 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -242,6 +242,12 @@ static int isdn_divert_ioctl_unlocked(struct file *file, uint cmd, ulong arg)
                 case IIOCDOCFINT:
                         if (!divert_if.drv_to_name(dioctl.cf_ctrl.drvid))
                                 return (-EINVAL);       /* invalid driver */
+                        if (strnlen(dioctl.cf_ctrl.msn, sizeof(dioctl.cf_ctrl.msn)) ==
+                                        sizeof(dioctl.cf_ctrl.msn))
+                                return -EINVAL;
+                        if (strnlen(dioctl.cf_ctrl.fwd_nr, sizeof(dioctl.cf_ctrl.fwd_nr)) ==
+                                        sizeof(dioctl.cf_ctrl.fwd_nr))
+                                return -EINVAL;
                         if ((i = cf_command(dioctl.cf_ctrl.drvid,
                                             (cmd == IIOCDOCFACT) ? 1 : (cmd == IIOCDOCFDIS) ? 0 : 2,
                                             dioctl.cf_ctrl.cfproc,