linux.git/drivers/staging/bcm, branch v2.6.37

Staging: bcm: use get_user() to access user pointers

2010-11-09T21:32:36+00:00

This fixes some places that dereference user pointers directly instead
of using get_user().

Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS.  The
original code modified the struct which "arg" was pointing to.  I think
this was a bug in the original code and that we only wanted to write to
the OutputBuffer. Also with the original code you could read as much
memory as you wanted so I had to put a cap on OutputLength.  The only
value of OutputLength that makes sense is sizeof(LINK_STATE) so now if
OutputLength is not sizeof(LINK_STATE) it returns -EINVAL.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: fix up network device reference counting

2010-10-28T16:54:23+00:00

The way network devices are reference counted does not include poking
around in the reference count itself.  This breaks when the reference
count is changed to be a different type.  Fix the driver to do the
proper function calls instead.

Cc: Stephen Hemminger 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: silence off by one warning

2010-10-08T14:29:57+00:00

"status" is used as an index into the Adapter->PackInfo[] array, which
has NO_OF_QUEUES elements.

This code actually works OK.  The SearchSfid() function always returns
a valid index or it returns NO_OF_QUEUES + 1.  But it looks sloppy and
it makes the static checkers complain.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: remove unneeded NULL check

2010-10-08T14:29:56+00:00

The error handling here is wrong.  If psIntfAdapter were NULL then we
would have a NULL dereference in the debug output on the error path.
But this function is only called from usbbcm_device_probe() when
psIntfAdapter is non-NULL.

Since the check isn't needed and I removed it instead of fixing it.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: return -EFAULT on copy_to_user() errors

2010-10-08T14:29:56+00:00

bcm/InterfaceDld.c had a couple places which returned the number of
bytes remaining instead of -EFAULT.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: dereferencing before checking

2010-10-08T14:29:55+00:00

I moved the check to see if "Adapter" was null in front of the
dereference.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: mocro expansion bug

2010-10-08T14:29:55+00:00

The WIMAX_MAX_MTU macro is used in drivers/staging/bcm/CmHost.c like
this:

    if (Adapter->PackInfo[uiSearchRuleIndex].uiMaxBucketSize < WIMAX_MAX_MTU * 8)

The multiplication by eight has precedence over the addition so the
macro needs parenthesis to work.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: make major and minor signed

2010-10-08T14:29:54+00:00

We assume that major is signed in register_control_device_interface().

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: return -EFAULT on copy_to_user() failures

2010-10-08T14:29:54+00:00

There were a number of places in the bcm_char_ioctl() which returned the
number of bytes remaining to be copied instead of returning -EFAULT.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: Makefile: replace the use of -objs with -y

2010-10-08T14:23:52+00:00

Changed -objs to -y in Makefile.

Signed-off-by: Tracey Dent 
Signed-off-by: Greg Kroah-Hartman