mISDN: Fix kernel crash when doing hardware conference with more than two members

[safe/jmp/linux-2.6] / drivers / isdn / capi / kcapi.c

diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index 063de5a..5360c4f 100644 (file)
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -10,7 +10,7 @@
  *
  */
 
-#define CONFIG_AVMB1_COMPAT
+#define AVMB1_COMPAT
 
 #include "kcapi.h"
 #include <linux/module.h>
@@ -29,7 +29,7 @@
 #include <asm/uaccess.h>
 #include <linux/isdn/capicmd.h>
 #include <linux/isdn/capiutil.h>
-#ifdef CONFIG_AVMB1_COMPAT
+#ifdef AVMB1_COMPAT
 #include <linux/b1lli.h>
 #endif
 #include <linux/mutex.h>
@@ -740,7 +740,7 @@ u16 capi20_get_profile(u32 contr, struct capi_profile *profp)
 
 EXPORT_SYMBOL(capi20_get_profile);
 
-#ifdef CONFIG_AVMB1_COMPAT
+#ifdef AVMB1_COMPAT
 static int old_capi_manufacturer(unsigned int cmd, void __user *data)
 {
        avmb1_loadandconfigdef ldef;
@@ -828,15 +828,18 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
                        return -ESRCH;
                if (card->load_firmware == NULL) {
                        printk(KERN_DEBUG "kcapi: load: no load function\n");
+                       capi_ctr_put(card);
                        return -ESRCH;
                }
 
                if (ldef.t4file.len <= 0) {
                        printk(KERN_DEBUG "kcapi: load: invalid parameter: length of t4file is %d ?\n", ldef.t4file.len);
+                       capi_ctr_put(card);
                        return -EINVAL;
                }
                if (ldef.t4file.data == NULL) {
                        printk(KERN_DEBUG "kcapi: load: invalid parameter: dataptr is 0\n");
+                       capi_ctr_put(card);
                        return -EINVAL;
                }
 
@@ -849,6 +852,7 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
 
                if (card->cardstate != CARD_DETECTED) {
                        printk(KERN_INFO "kcapi: load: contr=%d not in detect state\n", ldef.contr);
+                       capi_ctr_put(card);
                        return -EBUSY;
                }
                card->cardstate = CARD_LOADING;
@@ -904,7 +908,7 @@ int capi20_manufacturer(unsigned int cmd, void __user *data)
         struct capi_ctr *card;
 
        switch (cmd) {
-#ifdef CONFIG_AVMB1_COMPAT
+#ifdef AVMB1_COMPAT
        case AVMB1_LOAD:
        case AVMB1_LOAD_AND_CONFIG:
        case AVMB1_RESETCARD: