[PATCH] qlcnic: Fix return value in qlcnic_probe()

From: Yongjian Xu If the check of adapter fails and goes into the 'else' branch, the return value 'err' should not still be zero. Signed-off-by: Yongjian Xu --- drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c |1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/qlogic/q

[PATCH] drm: integer overflow in vmw_surface_define_ioctl()

From: xuyongjian req comes from user-space, then integer overflow may happen in this line: num_sizes += req->mip_levels[i]; Signed-off-by: xuyongjian --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers

[PATCH] drm: integer overflow in vmw_kms_update_layout_ioctl()

From: Yongjian Xu rects is copy_from_user. rects[i].x and rects[i].y are signed. rects[i].w and rects[i].h are unsigned. If rects[i].w is large enough, integer overflow could happen in: rects[i].x + rects[i].w rects[i].h has the same problem. Reported-by: Yongjian xu Suggested-by: Qixue Xiao

[PATCH] e1000: To filter the negative skb->len

From: Yongjian Xu skb->len is unsigned int, "skb->len <= 0" should be "(int)(skb->len) <= 0". Signed-off-by: Yongjian Xu --- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/driver

[PATCH] e1000: remove the check: skb->len<=0

From: Yongjian Xu There is no case skb->len would be 0 or 'negative'. Remove the check. Signed-off-by: Yongjian Xu --- drivers/net/ethernet/intel/e1000/e1000_main.c | 5 - 1 file changed, 5 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/int