select: deal with math overflow from borderline valid userland data

[linux-2.6-omap-h63xx.git] / drivers / atm / atmtcp.c

diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index 57f1810fdccd74df8f755d1aa1f935ccf68b482e..02ad83d6b562b6e0d14142a126622b26c7e9f180 100644 (file)
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -221,7 +221,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
        hdr->vpi = htons(vcc->vpi);
        hdr->vci = htons(vcc->vci);
        hdr->length = htonl(skb->len);
-       memcpy(skb_put(new_skb,skb->len),skb->data,skb->len);
+       skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
        if (vcc->pop) vcc->pop(vcc,skb);
        else dev_kfree_skb(skb);
        out_vcc->push(out_vcc,new_skb);
@@ -246,10 +246,6 @@ static void atmtcp_c_close(struct atm_vcc *vcc)
 {
        struct atm_dev *atmtcp_dev;
        struct atmtcp_dev_data *dev_data;
-       struct sock *s;
-       struct hlist_node *node;
-       struct atm_vcc *walk;
-       int i;
 
        atmtcp_dev = (struct atm_dev *) vcc->dev_data;
        dev_data = PRIV(atmtcp_dev);
@@ -257,20 +253,8 @@ static void atmtcp_c_close(struct atm_vcc *vcc)
        if (dev_data->persist) return;
        atmtcp_dev->dev_data = NULL;
        kfree(dev_data);
-       shutdown_atm_dev(atmtcp_dev);
+       atm_dev_deregister(atmtcp_dev);
        vcc->dev_data = NULL;
-       read_lock(&vcc_sklist_lock);
-       for(i = 0; i < VCC_HTABLE_SIZE; ++i) {
-               struct hlist_head *head = &vcc_hash[i];
-
-               sk_for_each(s, node, head) {
-                       walk = atm_sk(s);
-                       if (walk->dev != atmtcp_dev)
-                               continue;
-                       wake_up(s->sk_sleep);
-               }
-       }
-       read_unlock(&vcc_sklist_lock);
        module_put(THIS_MODULE);
 }
 
@@ -326,7 +310,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
                goto done;
        }
        __net_timestamp(new_skb);
-       memcpy(skb_put(new_skb,skb->len),skb->data,skb->len);
+       skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
        out_vcc->push(out_vcc,new_skb);
        atomic_inc(&vcc->stats->tx);
        atomic_inc(&out_vcc->stats->rx);
@@ -368,7 +352,7 @@ static struct atm_dev atmtcp_control_dev = {
        .ops            = &atmtcp_c_dev_ops,
        .type           = "atmtcp",
        .number         = 999,
-       .lock           = SPIN_LOCK_UNLOCKED
+       .lock           = __SPIN_LOCK_UNLOCKED(atmtcp_control_dev.lock)
 };
 
 
@@ -450,7 +434,7 @@ static int atmtcp_remove_persistent(int itf)
        if (PRIV(dev)->vcc) return 0;
        kfree(dev_data);
        atm_dev_put(dev);
-       shutdown_atm_dev(dev);
+       atm_dev_deregister(dev);
        return 0;
 }