1 files changed, 31 insertions, 14 deletions

diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 508945d1b9c1..c36f52137456 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -209,7 +209,7 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
                 err = -EFAULT;
-                goto drop;
+                goto done;
         }
 
         memcpy(mISDN_HEAD_P(skb), skb->data, MISDN_HEADER_LEN);
@@ -222,7 +222,7 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         } else { /* use default for L2 messages */
                 if ((sk->sk_protocol == ISDN_P_LAPD_TE) ||
                     (sk->sk_protocol == ISDN_P_LAPD_NT))
-                    mISDN_HEAD_ID(skb) = _pms(sk)->ch.nr;
+                        mISDN_HEAD_ID(skb) = _pms(sk)->ch.nr;
         }
 
         if (*debug & DEBUG_SOCKET)
@@ -230,19 +230,21 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                      __func__, mISDN_HEAD_ID(skb));
 
         err = -ENODEV;
-        if (!_pms(sk)->ch.peer ||
-            (err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb)))
-                goto drop;
-
-        err = len;
+        if (!_pms(sk)->ch.peer)
+                goto done;
+        err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb);
+        if (err)
+                goto done;
+        else {
+                skb = NULL;
+                err = len;
+        }
 
 done:
+        if (skb)
+                kfree_skb(skb);
         release_sock(sk);
         return err;
-
-drop:
-        kfree_skb(skb);
-        goto done;
 }
 
 static int
@@ -292,7 +294,7 @@ static int
 data_sock_ioctl_bound(struct sock *sk, unsigned int cmd, void __user *p)
 {
         struct mISDN_ctrl_req   cq;
-        int                     err = -EINVAL, val;
+        int                     err = -EINVAL, val[2];
         struct mISDNchannel     *bchan, *next;
 
         lock_sock(sk);
@@ -328,12 +330,27 @@ data_sock_ioctl_bound(struct sock *sk, unsigned int cmd, void __user *p)
                         err = -EINVAL;
                         break;
                 }
-                if (get_user(val, (int __user *)p)) {
+                val[0] = cmd;
+                if (get_user(val[1], (int __user *)p)) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = _pms(sk)->dev->teimgr->ctrl(_pms(sk)->dev->teimgr,
+                    CONTROL_CHANNEL, val);
+                break;
+        case IMHOLD_L1:
+                if (sk->sk_protocol != ISDN_P_LAPD_NT
+                 && sk->sk_protocol != ISDN_P_LAPD_TE) {
+                        err = -EINVAL;
+                        break;
+                }
+                val[0] = cmd;
+                if (get_user(val[1], (int __user *)p)) {
                         err = -EFAULT;
                         break;
                 }
                 err = _pms(sk)->dev->teimgr->ctrl(_pms(sk)->dev->teimgr,
-                    CONTROL_CHANNEL, &val);
+                    CONTROL_CHANNEL, val);
                 break;
         default:
                 err = -EINVAL;