From 09071e35f9f0b308c37c9853766de573591589ea Mon Sep 17 00:00:00 2001 From: Toni Mueller Date: Tue, 15 Nov 2005 00:09:14 -0800 Subject: [PATCH] sdladrv.c build fix gcc4 doesn't allow typecasted lvals. Cc: "David S. Miller" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/net/wan/sdladrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/wan/sdladrv.c b/drivers/net/wan/sdladrv.c index 7c2cf2e7630..032c0f81928 100644 --- a/drivers/net/wan/sdladrv.c +++ b/drivers/net/wan/sdladrv.c @@ -1994,7 +1994,7 @@ static int detect_s514 (sdlahw_t* hw) modname, hw->irq); /* map the physical PCI memory to virtual memory */ - (void *)hw->dpmbase = ioremap((unsigned long)S514_mem_base_addr, + hw->dpmbase = ioremap((unsigned long)S514_mem_base_addr, (unsigned long)MAX_SIZEOF_S514_MEMORY); /* map the physical control register memory to virtual memory */ hw->vector = (unsigned long)ioremap( -- cgit v1.2.3 From efb3442cf1c65747a858476e10f705612383eed1 Mon Sep 17 00:00:00 2001 From: Pekka Enberg Date: Wed, 16 Nov 2005 21:55:05 +0200 Subject: [PATCH] ipw2200: disallow direct scanning when device is down The function ipw_request_direct_scan() should bail out when the device is down. This fixes a lockup caused by wpa_supplicant triggering ipw_request_direct_scan() while the driver was in a middle of a reset due to firmware errors. Thanks to Zilvinas Valinskas for reporting the bug and helping me debug it. Signed-off-by: Pekka Enberg Acked-by: Zhu Yi Signed-off-by: Linus Torvalds --- drivers/net/wireless/ipw2200.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/net') diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c index b0d195d1721..374b682e4d6 100644 --- a/drivers/net/wireless/ipw2200.c +++ b/drivers/net/wireless/ipw2200.c @@ -8926,6 +8926,10 @@ static int ipw_request_direct_scan(struct ipw_priv *priv, char *essid, struct ipw_scan_request_ext scan; int err = 0, scan_type; + if (!(priv->status & STATUS_INIT) || + (priv->status & STATUS_EXIT_PENDING)) + return 0; + down(&priv->sem); if (priv->status & STATUS_RF_KILL_MASK) { -- cgit v1.2.3 From 3b26b1100e26811e54770abaa221eae140ba840d Mon Sep 17 00:00:00 2001 From: Zhu Yi Date: Thu, 17 Nov 2005 13:58:30 +0800 Subject: [PATCH] ipw2200: fix error log offset calculation This fixes a slab corruption issue in the ipw2200 driver: it essentially multiplied the error log number _twice_ by the size of the error element entry (once explicitly in the code, and once implicitly as part of the regular pointer arithmetic). Cc: Henrik Brix Andersen Cc: Bernard Blackham Cc: Zilvinas Valinskas Cc: Pekka Enberg Signed-off-by: Zhu Yi Signed-off-by: Linus Torvalds -- --- drivers/net/wireless/ipw2200.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c index 374b682e4d6..5e7c7e944c9 100644 --- a/drivers/net/wireless/ipw2200.c +++ b/drivers/net/wireless/ipw2200.c @@ -1110,8 +1110,7 @@ static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv) error->elem_len = elem_len; error->log_len = log_len; error->elem = (struct ipw_error_elem *)error->payload; - error->log = (struct ipw_event *)(error->elem + - (sizeof(*error->elem) * elem_len)); + error->log = (struct ipw_event *)(error->elem + elem_len); ipw_capture_event_log(priv, log_len, error->log); -- cgit v1.2.3