ipv6: fix out of bound writes in __ip6_append_data()

[pandora-kernel.git] / drivers / atm / idt77252.c

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 1c05212..81845fa 100644 (file)
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -1258,7 +1258,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
        tail = readl(SAR_REG_RAWCT);
 
        pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(queue),
-                                   skb_end_pointer(queue) - queue->head - 16,
+                                   skb_end_offset(queue) - 16,
                                    PCI_DMA_FROMDEVICE);
 
        while (head != tail) {
@@ -3513,7 +3513,7 @@ init_card(struct atm_dev *dev)
        tmp = dev_get_by_name(&init_net, tname);        /* jhs: was "tmp = dev_get(tname);" */
        if (tmp) {
                memcpy(card->atmdev->esi, tmp->dev_addr, 6);
-
+               dev_put(tmp);
                printk("%s: ESI %pM\n", card->name, card->atmdev->esi);
        }
        /*