Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (48 commits)
  net: Fix wrong interpretation of some copy_to_user() results.
  xfrm: alg_key_len & alg_icv_len should be unsigned
  [netdrvr] tehuti: move ioctl perm check closer to function start
  ipv6: Fix typo in net/ipv6/Kconfig
  via-velocity: fix vlan receipt
  tg3: sparse cleanup
  forcedeth: realtek phy crossover detection
  ibm_newemac: Increase MDIO timeouts
  gianfar: Fix skb allocation strategy
  netxen: reduce stack usage of netxen_nic_flash_print
  smc911x: test after postfix decrement fails in smc911x_{reset,drop_pkt}
  net drivers: fix platform driver hotplug/coldplug
  forcedeth: new backoff implementation
  ehea: make things static
  phylib: Add support for board-level PHY fixups
  [netdrvr] atlx: code movement: move atl1 parameter parsing
  atlx: remove flash vendor parameter
  korina: misc cleanup
  korina: fix misplaced return statement
  WAN: Fix confusing insmod error code for C101 too.
  ...

1 files changed, 4 insertions, 5 deletions

diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 1c509592574a..5ff0ce6e9d39 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 
                 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
 
-                if (width < len)
+                if (cnt + width < len)
                         tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
 
                 spin_unlock_bh(&tcp_probe.lock);
 
                 /* if record greater than space available
                    return partial buffer (so far) */
-                if (width >= len)
+                if (cnt + width >= len)
                         break;
 
-                error = copy_to_user(buf + cnt, tbuf, width);
-                if (error)
-                        break;
+                if (copy_to_user(buf + cnt, tbuf, width))
+                        return -EFAULT;
                 cnt += width;
         }