Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (59 commits)
  igbvf.txt: Add igbvf Documentation
  igb.txt: Add igb documentation
  e100/e1000*/igb*/ixgb*: Add missing read memory barrier
  ixgbe: fix build error with FCOE_CONFIG without DCB_CONFIG
  netxen: protect tx timeout recovery by rtnl lock
  isdn: gigaset: use after free
  isdn: gigaset: add missing unlock
  solos-pci: Fix race condition in tasklet RX handling
  pkt_sched: Fix sch_sfq vs tcf_bind_filter oops
  net: disable preemption before call smp_processor_id()
  tcp: no md5sig option size check bug
  iwlwifi: fix locking assertions
  iwlwifi: fix TX tracer
  isdn: fix information leak
  net: Fix napi_gro_frags vs netpoll path
  usbnet: remove noisy and hardly useful printk
  rtl8180: avoid potential NULL deref in rtl8180_beacon_work
  ath9k: Remove myself from the MAINTAINERS list
  libertas: scan before assocation if no BSSID was given
  libertas: fix association with some APs by using extended rates
  ...

3 files changed, 10 insertions, 7 deletions

diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 0ded3640b926..707d9c94cf9e 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
          * The next command will reopen the AT channel automatically.
          */
         if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
-                kfree(cb);
                 rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (cb->wake_tasklet)
                         tasklet_schedule(cb->wake_tasklet);
-                return rc < 0 ? rc : cb->len;
+                if (!rc)
+                        rc = cb->len;
+                kfree(cb);
+                return rc;
         }
 
         spin_lock_irqsave(&cs->cmdlock, flags);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index e5ea344a551a..bcc174e4f3b1 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -1052,6 +1052,7 @@ static inline void remove_appl_from_channel(struct bc_state *bcs,
         do {
                 if (bcap->bcnext == ap) {
                         bcap->bcnext = bcap->bcnext->bcnext;
+                        spin_unlock_irqrestore(&bcs->aplock, flags);
                         return;
                 }
                 bcap = bcap->bcnext;
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 43c5dc3516e5..4cfdbe08ffd1 100644
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                 pr_debug("%s: SCIOGETSPID: ioctl received\n",
                                 sc_adapter[card]->devicename);
 
-                spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
+                spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
                 if (!spid) {
                         kfree(rcvmsg);
                         return -ENOMEM;
@@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                         kfree(rcvmsg);
                         return status;
                 }
-                strcpy(spid, rcvmsg->msg_data.byte_array);
+                strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE);
 
                 /*
                  * Package the switch type and send to user space
@@ -266,12 +266,12 @@ int sc_ioctl(int card, scs_ioctl *data)
                         return status;
                 }
 
-                dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL);
+                dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL);
                 if (!dn) {
                         kfree(rcvmsg);
                         return -ENOMEM;
                 }
-                strcpy(dn, rcvmsg->msg_data.byte_array);
+                strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE);
                 kfree(rcvmsg);
 
                 /*
@@ -337,7 +337,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                 pr_debug("%s: SCIOSTAT: ioctl received\n",
                                 sc_adapter[card]->devicename);
 
-                bi = kmalloc (sizeof(boardInfo), GFP_KERNEL);
+                bi = kzalloc(sizeof(boardInfo), GFP_KERNEL);
                 if (!bi) {
                         kfree(rcvmsg);
                         return -ENOMEM;