6 files changed, 26 insertions, 19 deletions

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 29e66d603d3c..70667033a568 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -921,9 +921,9 @@ out_free_rbpq_base:
                         he_dev->rbrq_phys);
         i = CONFIG_RBPL_SIZE;
 out_free_rbpl_virt:
-        while (--i)
-                pci_pool_free(he_dev->rbps_pool, he_dev->rbpl_virt[i].virt,
-                                he_dev->rbps_base[i].phys);
+        while (i--)
+                pci_pool_free(he_dev->rbpl_pool, he_dev->rbpl_virt[i].virt,
+                                he_dev->rbpl_base[i].phys);
         kfree(he_dev->rbpl_virt);
 
 out_free_rbpl_base:
@@ -933,11 +933,11 @@ out_free_rbpl_base:
 out_destroy_rbpl_pool:
         pci_pool_destroy(he_dev->rbpl_pool);
 
-        i = CONFIG_RBPL_SIZE;
+        i = CONFIG_RBPS_SIZE;
 out_free_rbps_virt:
-        while (--i)
-                pci_pool_free(he_dev->rbpl_pool, he_dev->rbps_virt[i].virt,
-                                he_dev->rbpl_base[i].phys);
+        while (i--)
+                pci_pool_free(he_dev->rbps_pool, he_dev->rbps_virt[i].virt,
+                                he_dev->rbps_base[i].phys);
         kfree(he_dev->rbps_virt);
 
 out_free_rbps_base:
diff --git a/drivers/isdn/hardware/mISDN/Kconfig b/drivers/isdn/hardware/mISDN/Kconfig
index bde55d7287fa..eadc1cd34a20 100644
--- a/drivers/isdn/hardware/mISDN/Kconfig
+++ b/drivers/isdn/hardware/mISDN/Kconfig
@@ -78,6 +78,7 @@ config MISDN_NETJET
         depends on PCI
         select MISDN_IPAC
         select ISDN_HDLC
+        select ISDN_I4L
         help
           Enable support for Traverse Technologies NETJet PCI cards.
 
diff --git a/drivers/isdn/i4l/Kconfig b/drivers/isdn/i4l/Kconfig
index dd744ffd240b..07c4e49f9e77 100644
--- a/drivers/isdn/i4l/Kconfig
+++ b/drivers/isdn/i4l/Kconfig
@@ -141,8 +141,7 @@ endmenu
 endif
 
 config ISDN_HDLC
-        tristate 
-        depends on HISAX_ST5481
+        tristate
         select CRC_CCITT
         select BITREVERSE
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index fbcac76fdc0d..4102de1022ee 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -641,15 +641,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 
         case SO_BINDTODEVICE:
                 if (optlen > IFNAMSIZ)
-                        optlen=IFNAMSIZ;
-                if (copy_from_user(devname, optval, optlen)) {
-                res = -EFAULT;
-                        break;
-                }
+                        optlen = IFNAMSIZ;
 
-                dev = dev_get_by_name(&init_net, devname);
-                if (dev == NULL) {
-                        res = -ENODEV;
+                if (copy_from_user(devname, optval, optlen)) {
+                        res = -EFAULT;
                         break;
                 }
 
@@ -657,12 +652,18 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
                    (sock->state != SS_UNCONNECTED ||
                     sk->sk_state == TCP_LISTEN)) {
                         res = -EADDRNOTAVAIL;
-                        dev_put(dev);
+                        break;
+                }
+
+                dev = dev_get_by_name(&init_net, devname);
+                if (!dev) {
+                        res = -ENODEV;
                         break;
                 }
 
                 ax25->ax25_dev = ax25_dev_ax25dev(dev);
                 ax25_fillin_cb(ax25, ax25->ax25_dev);
+                dev_put(dev);
                 break;
 
         default:
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 142ebac14176..b1b3b0fbf41c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -432,6 +432,7 @@ err2:
         br_fdb_delete_by_port(br, p, 1);
 err1:
         kobject_put(&p->kobj);
+        p = NULL; /* kobject_put frees */
 err0:
         dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/socket.c b/net/socket.c
index 49917a1cac7d..41e8847508aa 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         unsigned long a[6];
         unsigned long a0, a1;
         int err;
+        unsigned int len;
 
         if (call < 1 || call > SYS_ACCEPT4)
                 return -EINVAL;
 
+        len = nargs[call];
+        if (len > sizeof(a))
+                return -EINVAL;
+
         /* copy_from_user should be SMP safe. */
-        if (copy_from_user(a, args, nargs[call]))
+        if (copy_from_user(a, args, len))
                 return -EFAULT;
 
         audit_socketcall(nargs[call] / sizeof(unsigned long), a);