Merge branch 'master' into for-linus

4 files changed, 19 insertions, 13 deletions

diff --git a/drivers/message/i2o/exec-osm.c b/drivers/message/i2o/exec-osm.c
index 06c655c55587..a3970e56ae53 100644
--- a/drivers/message/i2o/exec-osm.c
+++ b/drivers/message/i2o/exec-osm.c
@@ -389,12 +389,16 @@ static int i2o_exec_lct_notify(struct i2o_controller *c, u32 change_ind)
         dev = &c->pdev->dev;
 
         if (i2o_dma_realloc(dev, &c->dlct,
-                                        le32_to_cpu(sb->expected_lct_size)))
+                                        le32_to_cpu(sb->expected_lct_size))) {
+                mutex_unlock(&c->lct_lock);
                 return -ENOMEM;
+        }
 
         msg = i2o_msg_get_wait(c, I2O_TIMEOUT_MESSAGE_GET);
-        if (IS_ERR(msg))
+        if (IS_ERR(msg)) {
+                mutex_unlock(&c->lct_lock);
                 return PTR_ERR(msg);
+        }
 
         msg->u.head[0] = cpu_to_le32(EIGHT_WORD_MSG_SIZE | SGL_OFFSET_6);
         msg->u.head[1] = cpu_to_le32(I2O_CMD_LCT_NOTIFY << 24 | HOST_TID << 12 |
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index e6733bc99724..f0f1e667000f 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -727,7 +727,7 @@ static int i2o_block_transfer(struct request *req)
 {
         struct i2o_block_device *dev = req->rq_disk->private_data;
         struct i2o_controller *c;
-        u32 tid = dev->i2o_dev->lct_data.tid;
+        u32 tid;
         struct i2o_message *msg;
         u32 *mptr;
         struct i2o_block_request *ireq = req->special;
@@ -743,6 +743,7 @@ static int i2o_block_transfer(struct request *req)
                 goto exit;
         }
 
+        tid = dev->i2o_dev->lct_data.tid;
         c = dev->i2o_dev->iop;
 
         msg = i2o_msg_get(c);
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index c4b117f5fb70..068ba0785bb4 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -111,11 +111,11 @@ static int i2o_cfg_gethrt(unsigned long arg)
 
         len = 8 + ((hrt->entry_len * hrt->num_entries) << 2);
 
-        /* We did a get user...so assuming mem is ok...is this bad? */
-        put_user(len, kcmd.reslen);
-        if (len > reslen)
+        if (put_user(len, kcmd.reslen))
+                ret = -EFAULT;
+        else if (len > reslen)
                 ret = -ENOBUFS;
-        if (copy_to_user(kcmd.resbuf, (void *)hrt, len))
+        else if (copy_to_user(kcmd.resbuf, (void *)hrt, len))
                 ret = -EFAULT;
 
         return ret;
@@ -147,8 +147,9 @@ static int i2o_cfg_getlct(unsigned long arg)
         lct = (i2o_lct *) c->lct;
 
         len = (unsigned int)lct->table_size << 2;
-        put_user(len, kcmd.reslen);
-        if (len > reslen)
+        if (put_user(len, kcmd.reslen))
+                ret = -EFAULT;
+        else if (len > reslen)
                 ret = -ENOBUFS;
         else if (copy_to_user(kcmd.resbuf, lct, len))
                 ret = -EFAULT;
@@ -208,8 +209,9 @@ static int i2o_cfg_parms(unsigned long arg, unsigned int type)
                 return -EAGAIN;
         }
 
-        put_user(len, kcmd.reslen);
-        if (len > reslen)
+        if (put_user(len, kcmd.reslen))
+                ret = -EFAULT;
+        else if (len > reslen)
                 ret = -ENOBUFS;
         else if (copy_to_user(kcmd.resbuf, res, len))
                 ret = -EFAULT;
diff --git a/drivers/message/i2o/i2o_scsi.c b/drivers/message/i2o/i2o_scsi.c
index 3d45817e6dcd..ea6b2197da8a 100644
--- a/drivers/message/i2o/i2o_scsi.c
+++ b/drivers/message/i2o/i2o_scsi.c
@@ -528,7 +528,6 @@ static int i2o_scsi_queuecommand(struct scsi_cmnd *SCpnt,
          *      Do the incoming paperwork
          */
         i2o_dev = SCpnt->device->hostdata;
-        c = i2o_dev->iop;
 
         SCpnt->scsi_done = done;
 
@@ -538,7 +537,7 @@ static int i2o_scsi_queuecommand(struct scsi_cmnd *SCpnt,
                 done(SCpnt);
                 goto exit;
         }
-
+        c = i2o_dev->iop;
         tid = i2o_dev->lct_data.tid;
 
         osm_debug("qcmd: Tid = %03x\n", tid);