[kernel] r16742 - dists/sid/linux-2.6/debian/patches/bugfix/all

[Ben Hutchings]

Author: benh
Date: Wed Dec 29 00:47:12 2010
New Revision: 16742

Log:
Use dannf's working backport of "irda: prevent integer underflow in IRLMP_ENUMDEVICES"

Modified:
   dists/sid/linux-2.6/debian/patches/bugfix/all/irda-prevent-integer-underflow-in-IRLMP_ENUMDEVICES.patch

Modified: dists/sid/linux-2.6/debian/patches/bugfix/all/irda-prevent-integer-underflow-in-IRLMP_ENUMDEVICES.patch
==============================================================================
--- dists/sid/linux-2.6/debian/patches/bugfix/all/irda-prevent-integer-underflow-in-IRLMP_ENUMDEVICES.patch	Tue Dec 28 04:21:28 2010	(r16741)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/irda-prevent-integer-underflow-in-IRLMP_ENUMDEVICES.patch	Wed Dec 29 00:47:12 2010	(r16742)
@@ -12,16 +12,11 @@
 
 Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
 Signed-off-by: David S. Miller <davem at davemloft.net>
-[bwh: Adjust context for 2.6.32]
+[dannf: Backport to 2.6.32]
 ---
- net/irda/af_irda.c |   18 +++++++++++-------
- 1 files changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index b6cef980..ed5173b 100644
 --- a/net/irda/af_irda.c
 +++ b/net/irda/af_irda.c
-@@ -2164,6 +2164,16 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
+@@ -2164,6 +2164,14 @@ static int irda_getsockopt(struct socket
  
  	switch (optname) {
  	case IRLMP_ENUMDEVICES:
@@ -30,15 +25,13 @@
 +		offset = sizeof(struct irda_device_list) -
 +			sizeof(struct irda_device_info);
 +
-+		if (len < offset) {
-+			err = -EINVAL;
-+			goto out;
-+		}
++		if (len < offset)
++			return -EINVAL;
 +
  		/* Ask lmp for the current discovery log */
  		discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
  						    self->nslots);
-@@ -2173,15 +2183,9 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
+@@ -2173,15 +2181,9 @@ static int irda_getsockopt(struct socket
  		err = 0;
  
  		/* Write total list length back to client */
@@ -55,6 +48,3 @@
  		/* Copy the list itself - watch for overflow */
  		if(list.len > 2048)
  		{
--- 
-1.7.2.3
-