diff options
| -rw-r--r-- | drivers/net/wireless/libertas/debugfs.c | 29 |
1 files changed, 19 insertions, 10 deletions
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c index d3a47cc9547..b0a76c5bec6 100644 --- a/drivers/net/wireless/libertas/debugfs.c +++ b/drivers/net/wireless/libertas/debugfs.c @@ -293,18 +293,23 @@ static ssize_t lbs_setuserscan(struct file *file, struct lbs_ioctl_user_scan_cfg *scan_cfg; union iwreq_data wrqu; int dur; - unsigned long addr = get_zeroed_page(GFP_KERNEL); - char *buf = (char *)addr; + char *buf = (char *)get_zeroed_page(GFP_KERNEL); - scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL); - if (!scan_cfg) + if (!buf) return -ENOMEM; - + buf_size = min(count, len - 1); if (copy_from_user(buf, userbuf, buf_size)) { res = -EFAULT; - goto out_unlock; + goto out_buf; + } + + scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL); + if (!scan_cfg) { + res = -ENOMEM; + goto out_buf; } + res = count; scan_cfg->bsstype = LBS_SCAN_BSS_TYPE_ANY; @@ -317,15 +322,19 @@ static ssize_t lbs_setuserscan(struct file *file, lbs_scan_networks(priv, scan_cfg, 1); wait_event_interruptible(priv->adapter->cmd_pending, - !priv->adapter->nr_cmd_pending); + priv->adapter->surpriseremoved || !priv->adapter->nr_cmd_pending); + + if (priv->adapter->surpriseremoved) + goto out_scan_cfg; memset(&wrqu, 0x00, sizeof(union iwreq_data)); wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL); -out_unlock: - free_page(addr); + out_scan_cfg: kfree(scan_cfg); - return count; + out_buf: + free_page((unsigned long)buf); + return res; } |