This fixes some places that dereference user pointers directly instead
of using get_user().
Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS. The
original code modified the struct which "arg" was pointing to. I think
this was a bug in the original code and that we only wanted to write to
the OutputBuffer. Also with the original code you could read as much
memory as you wanted so I had to put a cap on OutputLength. The only
value of OutputLength that makes sense is sizeof(LINK_STATE) so now if
OutputLength is not sizeof(LINK_STATE) it returns -EINVAL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The way network devices are reference counted does not include poking
around in the reference count itself. This breaks when the reference
count is changed to be a different type. Fix the driver to do the
proper function calls instead.
Cc: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
"status" is used as an index into the Adapter->PackInfo[] array, which
has NO_OF_QUEUES elements.
This code actually works OK. The SearchSfid() function always returns
a valid index or it returns NO_OF_QUEUES + 1. But it looks sloppy and
it makes the static checkers complain.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The error handling here is wrong. If psIntfAdapter were NULL then we
would have a NULL dereference in the debug output on the error path.
But this function is only called from usbbcm_device_probe() when
psIntfAdapter is non-NULL.
Since the check isn't needed and I removed it instead of fixing it.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
bcm/InterfaceDld.c had a couple places which returned the number of
bytes remaining instead of -EFAULT.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
I moved the check to see if "Adapter" was null in front of the
dereference.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The WIMAX_MAX_MTU macro is used in drivers/staging/bcm/CmHost.c like
this:
if (Adapter->PackInfo[uiSearchRuleIndex].uiMaxBucketSize < WIMAX_MAX_MTU * 8)
The multiplication by eight has precedence over the addition so the
macro needs parenthesis to work.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
We assume that major is signed in register_control_device_interface().
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
There were a number of places in the bcm_char_ioctl() which returned the
number of bytes remaining to be copied instead of returning -EFAULT.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This marks up the code where sparse complains in most cases.
Most of the changes are in the ioctl handling code, which
gets __user annotations, finding one unchecked user access.
The rest is mostly about marking functions static when they
are only used in one file.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This removes all warnings I get on a 64 bit build except
for those that look unfixable, where we convert a pointer
to a 32 bit integer and change its byte order!
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
As a preparation for changing the default behaviour of llseek to no_llseek,
every file_operations structure should have a .llseek operation.
There are three new instances in staging now, which can all be changed
into no_llseek explicitly since the devices do not need to seek.
Add nonseekable_open where appropriate, to prevent pread/pwrite as well.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Handle build case of CONFIG_PM not being enabled.
drivers/staging/bcm/InterfaceInit.c:280: error: 'struct usb_device' has no member named 'autosuspend_delay'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix lots of printk format warnings in bcm. Here is a sample of them:
drivers/staging/bcm/CmHost.c:1955: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'long unsigned int'
drivers/staging/bcm/CmHost.c:1955: warning: format '%x' expects type 'unsigned int', but argument 2 has type 'long unsigned int'
drivers/staging/bcm/CmHost.c:1955: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'long unsigned int'
drivers/staging/bcm/LeakyBucket.c:85: warning: format '%d' expects type 'int', but argument 4 has type 'long int'
drivers/staging/bcm/LeakyBucket.c:85: warning: format '%d' expects type 'int', but argument 3 has type 'long int'
drivers/staging/bcm/LeakyBucket.c:85: warning: format '%d' expects type 'int', but argument 4 has type 'long int'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The Sprint 4G network uses a Wimax dongle with Beecem
chipset. The driver is typical of out of tree drivers, but
maybe useful for people, and the hardware is readily available.
Here is a staging ready version (i.e warts and all)
0. Started with Rel_5.2.7.3P1_USB from Sprint4GDeveloperPack-1.1
1. Consolidated files in staging
2. Remove Dos cr/lf
3. Remove unnecessary ioctl from usbbcm_fops
Applied patches that were in the developer pack, surprising
there were ones for 2.6.35 already.
This is compile tested only, see TODO for what still needs
to be done.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
