Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (22 commits)
  netlink: bug fix: wrong size was calculated for vfinfo list blob
  netlink: bug fix: don't overrun skbs on vf_port dump
  xt_tee: use skb_dst_drop()
  netdev/fec: fix ifconfig eth0 down hang issue
  cnic: Fix context memory init. on 5709.
  drivers/net: Eliminate a NULL pointer dereference
  drivers/net/hamradio: Eliminate a NULL pointer dereference
  be2net: Patch removes redundant while statement in loop.
  ipv6: Add GSO support on forwarding path
  net: fix __neigh_event_send()
  vhost: fix the memory leak which will happen when memory_access_ok fails
  vhost-net: fix to check the return value of copy_to/from_user() correctly
  vhost: fix to check the return value of copy_to/from_user() correctly
  vhost: Fix host panic if ioctl called with wrong index
  net: fix lock_sock_bh/unlock_sock_bh
  net/iucv: Add missing spin_unlock
  net: ll_temac: fix checksum offload logic
  net: ll_temac: fix interrupt bug when interrupt 0 is used
  sctp: dubious bitfields in sctp_transport
  ipmr: off by one in __ipmr_fill_mroute()
  ...

2 files changed, 39 insertions, 32 deletions

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index aa88911c9504..0f41c9195e9b 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -593,17 +593,17 @@ static long vhost_net_ioctl(struct file *f, unsigned int ioctl,
         int r;
         switch (ioctl) {
         case VHOST_NET_SET_BACKEND:
-                r = copy_from_user(&backend, argp, sizeof backend);
-                if (r < 0)
-                        return r;
+                if (copy_from_user(&backend, argp, sizeof backend))
+                        return -EFAULT;
                 return vhost_net_set_backend(n, backend.index, backend.fd);
         case VHOST_GET_FEATURES:
                 features = VHOST_FEATURES;
-                return copy_to_user(featurep, &features, sizeof features);
+                if (copy_to_user(featurep, &features, sizeof features))
+                        return -EFAULT;
+                return 0;
         case VHOST_SET_FEATURES:
-                r = copy_from_user(&features, featurep, sizeof features);
-                if (r < 0)
-                        return r;
+                if (copy_from_user(&features, featurep, sizeof features))
+                        return -EFAULT;
                 if (features & ~VHOST_FEATURES)
                         return -EOPNOTSUPP;
                 return vhost_net_set_features(n, features);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c6fb8e968f21..3b83382e06eb 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -320,10 +320,8 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
 {
         struct vhost_memory mem, *newmem, *oldmem;
         unsigned long size = offsetof(struct vhost_memory, regions);
-        long r;
-        r = copy_from_user(&mem, m, size);
-        if (r)
-                return r;
+        if (copy_from_user(&mem, m, size))
+                return -EFAULT;
         if (mem.padding)
                 return -EOPNOTSUPP;
         if (mem.nregions > VHOST_MEMORY_MAX_NREGIONS)
@@ -333,15 +331,16 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                 return -ENOMEM;
 
         memcpy(newmem, &mem, size);
-        r = copy_from_user(newmem->regions, m->regions,
-                           mem.nregions * sizeof *m->regions);
-        if (r) {
+        if (copy_from_user(newmem->regions, m->regions,
+                           mem.nregions * sizeof *m->regions)) {
                 kfree(newmem);
-                return r;
+                return -EFAULT;
         }
 
-        if (!memory_access_ok(d, newmem, vhost_has_feature(d, VHOST_F_LOG_ALL)))
+        if (!memory_access_ok(d, newmem, vhost_has_feature(d, VHOST_F_LOG_ALL))) {
+                kfree(newmem);
                 return -EFAULT;
+        }
         oldmem = d->memory;
         rcu_assign_pointer(d->memory, newmem);
         synchronize_rcu();
@@ -374,7 +373,7 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
         r = get_user(idx, idxp);
         if (r < 0)
                 return r;
-        if (idx > d->nvqs)
+        if (idx >= d->nvqs)
                 return -ENOBUFS;
 
         vq = d->vqs + idx;
@@ -389,9 +388,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                         r = -EBUSY;
                         break;
                 }
-                r = copy_from_user(&s, argp, sizeof s);
-                if (r < 0)
+                if (copy_from_user(&s, argp, sizeof s)) {
+                        r = -EFAULT;
                         break;
+                }
                 if (!s.num || s.num > 0xffff || (s.num & (s.num - 1))) {
                         r = -EINVAL;
                         break;
@@ -405,9 +405,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                         r = -EBUSY;
                         break;
                 }
-                r = copy_from_user(&s, argp, sizeof s);
-                if (r < 0)
+                if (copy_from_user(&s, argp, sizeof s)) {
+                        r = -EFAULT;
                         break;
+                }
                 if (s.num > 0xffff) {
                         r = -EINVAL;
                         break;
@@ -419,12 +420,14 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
         case VHOST_GET_VRING_BASE:
                 s.index = idx;
                 s.num = vq->last_avail_idx;
-                r = copy_to_user(argp, &s, sizeof s);
+                if (copy_to_user(argp, &s, sizeof s))
+                        r = -EFAULT;
                 break;
         case VHOST_SET_VRING_ADDR:
-                r = copy_from_user(&a, argp, sizeof a);
-                if (r < 0)
+                if (copy_from_user(&a, argp, sizeof a)) {
+                        r = -EFAULT;
                         break;
+                }
                 if (a.flags & ~(0x1 << VHOST_VRING_F_LOG)) {
                         r = -EOPNOTSUPP;
                         break;
@@ -477,9 +480,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 vq->used = (void __user *)(unsigned long)a.used_user_addr;
                 break;
         case VHOST_SET_VRING_KICK:
-                r = copy_from_user(&f, argp, sizeof f);
-                if (r < 0)
+                if (copy_from_user(&f, argp, sizeof f)) {
+                        r = -EFAULT;
                         break;
+                }
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
                 if (IS_ERR(eventfp)) {
                         r = PTR_ERR(eventfp);
@@ -492,9 +496,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                         filep = eventfp;
                 break;
         case VHOST_SET_VRING_CALL:
-                r = copy_from_user(&f, argp, sizeof f);
-                if (r < 0)
+                if (copy_from_user(&f, argp, sizeof f)) {
+                        r = -EFAULT;
                         break;
+                }
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
                 if (IS_ERR(eventfp)) {
                         r = PTR_ERR(eventfp);
@@ -510,9 +515,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                         filep = eventfp;
                 break;
         case VHOST_SET_VRING_ERR:
-                r = copy_from_user(&f, argp, sizeof f);
-                if (r < 0)
+                if (copy_from_user(&f, argp, sizeof f)) {
+                        r = -EFAULT;
                         break;
+                }
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
                 if (IS_ERR(eventfp)) {
                         r = PTR_ERR(eventfp);
@@ -575,9 +581,10 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, unsigned long arg)
                 r = vhost_set_memory(d, argp);
                 break;
         case VHOST_SET_LOG_BASE:
-                r = copy_from_user(&p, argp, sizeof p);
-                if (r < 0)
+                if (copy_from_user(&p, argp, sizeof p)) {
+                        r = -EFAULT;
                         break;
+                }
                 if ((u64)(unsigned long)p != p) {
                         r = -EFAULT;
                         break;