The following commit has been merged in the merge/master branch: commit 114127291352219aa50a1664cfa1180a65f2c036 Merge: 0fa214b2307ec8df272bb16c66248b3f1a3e4c84 d22e13c6c380261cf0b13d34e6412a1e393b5197 Author: Marek Lindner lindner_marek@yahoo.de Date: Mon Dec 12 18:52:28 2011 +0800

Merge remote-tracking branch 'origin/standalone/next' into merge/master

diff --combined net/batman-adv/icmp_socket.c index defd692,d9c1e7b..d9c1e7b --- a/net/batman-adv/icmp_socket.c +++ b/net/batman-adv/icmp_socket.c @@@ -136,10 -136,9 +136,9 @@@ static ssize_t bat_socket_read(struct f

spin_unlock_bh(&socket_client->lock);

- error = __copy_to_user(buf, &socket_packet->icmp_packet, - socket_packet->icmp_len); + packet_len = min(count, socket_packet->icmp_len); + error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);

- packet_len = socket_packet->icmp_len; kfree(socket_packet);

if (error) @@@ -187,12 -186,7 +186,7 @@@ static ssize_t bat_socket_write(struct skb_reserve(skb, sizeof(struct ethhdr)); icmp_packet = (struct icmp_packet_rr *)skb_put(skb, packet_len);

- if (!access_ok(VERIFY_READ, buff, packet_len)) { - len = -EFAULT; - goto free_skb; - } - - if (__copy_from_user(icmp_packet, buff, packet_len)) { + if (copy_from_user(icmp_packet, buff, packet_len)) { len = -EFAULT; goto free_skb; }