package/kernel/broadcom-wl/patches/919-fix-compilation-warning-for-stack-limit.patch

   1 --- a/driver/wl_iw.c
   2 +++ b/driver/wl_iw.c
   3 @@ -495,9 +495,9 @@ wl_iw_get_range(
   4  )
   5  {
   6         struct iw_range *range = (struct iw_range *) extra;
   7 -       int channels[MAXCHANNEL+1];
   8 -       wl_uint32_list_t *list = (wl_uint32_list_t *) channels;
   9 -       wl_rateset_t rateset;
  10 +       int *channels;
  11 +       wl_uint32_list_t *list;
  12 +       wl_rateset_t *rateset;
  13         int error, i;
  14         uint sf, ch;
  15
  16 @@ -506,6 +506,17 @@ wl_iw_get_range(
  17         if (!extra)
  18                 return -EINVAL;
  19
  20 +       channels = kcalloc(MAXCHANNEL+1, sizeof(*channels), GFP_KERNEL);
  21 +       if (!channels)
  22 +               return -ENOMEM;
  23 +       list = (wl_uint32_list_t *) channels;
  24 +
  25 +       rateset = kzalloc(sizeof(*rateset), GFP_KERNEL);
  26 +       if (!rateset) {
  27 +               error = -ENOMEM;
  28 +               goto free_channels;
  29 +       }
  30 +
  31         dwrq->length = sizeof(struct iw_range);
  32         memset(range, 0, sizeof(range));
  33
  34 @@ -514,8 +525,9 @@ wl_iw_get_range(
  35
  36         /* Set available channels/frequencies */
  37         list->count = htod32(MAXCHANNEL);
  38 -       if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, sizeof(channels))))
  39 -               return error;
  40 +       if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels,
  41 +                                  (MAXCHANNEL+1) * sizeof(*channels))))
  42 +               goto free_rateset;
  43         for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
  44                 range->freq[i].i = dtoh32(list->element[i]);
  45
  46 @@ -549,19 +561,19 @@ wl_iw_get_range(
  47  #endif /* WIRELESS_EXT > 11 */
  48
  49         /* Set available bitrates */
  50 -       if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
  51 -               return error;
  52 -       rateset.count = dtoh32(rateset.count);
  53 -       range->num_bitrates = rateset.count;
  54 -       for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
  55 -               range->bitrate[i] = (rateset.rates[i] & 0x7f) * 500000; /* convert to bps */
  56 +       if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, rateset, sizeof(*rateset))))
  57 +               goto free_rateset;
  58 +       rateset->count = dtoh32(rateset->count);
  59 +       range->num_bitrates = rateset->count;
  60 +       for (i = 0; i < rateset->count && i < IW_MAX_BITRATES; i++)
  61 +               range->bitrate[i] = (rateset->rates[i] & 0x7f) * 500000; /* convert to bps */
  62
  63         /* Set an indication of the max TCP throughput
  64          * in bit/s that we can expect using this interface.
  65          * May be use for QoS stuff... Jean II
  66          */
  67         if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i))))
  68 -               return error;
  69 +               goto free_rateset;
  70         i = dtoh32(i);
  71         if (i == WLC_PHY_TYPE_A)
  72                 range->throughput = 24000000;   /* 24 Mbits/s */
  73 @@ -624,7 +636,12 @@ wl_iw_get_range(
  74  #endif
  75  #endif /* WIRELESS_EXT > 17 */
  76
  77 -       return 0;
  78 +free_rateset:
  79 +       kfree(rateset);
  80 +free_channels:
  81 +       kfree(channels);
  82 +
  83 +       return error;
  84  }
  85
  86  static int
  87 --- a/driver/bcmsrom.c
  88 +++ b/driver/bcmsrom.c
  89 @@ -437,20 +437,37 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
  90             uint byteoff, uint nbytes, uint16 *buf)
  91  {
  92         uint i, nw, crc_range;
  93 -       uint16 old[SROM_MAXW], new[SROM_MAXW];
  94 +       uint16 *old, *new;
  95         uint8 crc;
  96         volatile uint32 val32;
  97 +       int rc = 0;
  98
  99         ASSERT(bustype == BUSTYPE(bustype));
 100
 101 +       old = MALLOC(osh, SROM_MAXW);
 102 +       ASSERT(old != NULL);
 103 +       if (!old)
 104 +               return -2;
 105 +
 106 +       new = MALLOC(osh, SROM_MAXW);
 107 +       ASSERT(new != NULL);
 108 +       if (!new) {
 109 +               rc = -2;
 110 +               goto free_old;
 111 +       }
 112 +
 113         /* check input - 16-bit access only. use byteoff 0x55aa to indicate
 114          * srclear
 115          */
 116 -       if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1)))
 117 -               return 1;
 118 +       if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1))) {
 119 +               rc = 1;
 120 +               goto free_new;
 121 +       }
 122
 123 -       if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX))
 124 -               return 1;
 125 +       if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX)) {
 126 +               rc = 1;
 127 +               goto free_new;
 128 +       }
 129
 130         if (BUSTYPE(bustype) == PCMCIA_BUS) {
 131                 crc_range = SROM_MAX;
 132 @@ -467,8 +484,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 133
 134         nw = crc_range / 2;
 135         /* read first small number words from srom, then adjust the length, read all */
 136 -       if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
 137 -               return 1;
 138 +       if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
 139 +               rc = 1;
 140 +               goto free_new;
 141 +       }
 142
 143         BS_ERROR(("%s: old[SROM4_SIGN] 0x%x, old[SROM8_SIGN] 0x%x\n",
 144                   __FUNCTION__, old[SROM4_SIGN], old[SROM8_SIGN]));
 145 @@ -481,10 +500,13 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 146                                 __FUNCTION__, buf[SROM4_SIGN], buf[SROM8_SIGN]));
 147
 148                         /* block invalid buffer size */
 149 -                       if (nbytes < SROM4_WORDS * 2)
 150 -                               return BCME_BUFTOOSHORT;
 151 -                       else if (nbytes > SROM4_WORDS * 2)
 152 -                               return BCME_BUFTOOLONG;
 153 +                       if (nbytes < SROM4_WORDS * 2) {
 154 +                               rc = BCME_BUFTOOSHORT;
 155 +                               goto free_new;
 156 +                       } else if (nbytes > SROM4_WORDS * 2) {
 157 +                               rc = BCME_BUFTOOLONG;
 158 +                               goto free_new;
 159 +                       }
 160
 161                         nw = SROM4_WORDS;
 162                 } else if (nbytes == SROM_WORDS * 2){ /* the other possible SROM format */
 163 @@ -493,17 +515,22 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 164                         nw = SROM_WORDS;
 165                 } else {
 166                         BS_ERROR(("%s: Invalid input file signature\n", __FUNCTION__));
 167 -                       return BCME_BADARG;
 168 +                       rc = BCME_BADARG;
 169 +                       goto free_new;
 170                 }
 171                 crc_range = nw * 2;
 172 -               if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
 173 -                       return 1;
 174 +               if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
 175 +                       rc = 1;
 176 +                       goto free_new;
 177 +               }
 178         } else if ((old[SROM4_SIGN] == SROM4_SIGNATURE) ||
 179             (old[SROM8_SIGN] == SROM4_SIGNATURE)) {
 180                 nw = SROM4_WORDS;
 181                 crc_range = nw * 2;
 182 -               if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
 183 -                       return 1;
 184 +               if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
 185 +                       rc = 1;
 186 +                       goto free_new;
 187 +               }
 188         } else {
 189                 /* Assert that we have already read enough for sromrev 2 */
 190                 ASSERT(crc_range >= SROM_WORDS * 2);
 191 @@ -562,8 +589,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 192                 }
 193         } else if (BUSTYPE(bustype) == PCMCIA_BUS) {
 194                 /* enable writes to the SPROM */
 195 -               if (sprom_cmd_pcmcia(osh, SROM_WEN))
 196 -                       return 1;
 197 +               if (sprom_cmd_pcmcia(osh, SROM_WEN)) {
 198 +                       rc = 1;
 199 +                       goto free_new;
 200 +               }
 201                 bcm_mdelay(WRITE_ENABLE_DELAY);
 202                 /* write srom */
 203                 for (i = 0; i < nw; i++) {
 204 @@ -573,14 +602,15 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 205                         }
 206                 }
 207                 /* disable writes to the SPROM */
 208 -               if (sprom_cmd_pcmcia(osh, SROM_WDS))
 209 -                       return 1;
 210 +               if (sprom_cmd_pcmcia(osh, SROM_WDS)) {
 211 +                       rc = 1;
 212 +                       goto free_new;
 213 +               }
 214         } else if (BUSTYPE(bustype) == SI_BUS) {
 215  #if defined(BCMUSBDEV)
 216                 if (SPROMBUS == PCMCIA_BUS) {
 217                         uint origidx;
 218                         void *regs;
 219 -                       int rc;
 220                         bool wasup;
 221
 222                         origidx = si_coreidx(sih);
 223 @@ -596,16 +626,24 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 224                                 si_core_disable(sih, 0);
 225
 226                         si_setcoreidx(sih, origidx);
 227 -                       return rc;
 228 +                       goto free_new;
 229                 }
 230  #endif
 231 -               return 1;
 232 +               rc = 1;
 233 +               goto free_new;
 234         } else {
 235 -               return 1;
 236 +               rc = 1;
 237 +               goto free_new;
 238         }
 239
 240         bcm_mdelay(WRITE_ENABLE_DELAY);
 241 -       return 0;
 242 +       rc = 0;
 243 +
 244 +free_new:
 245 +       MFREE(osh, new, SROM_MAXW);
 246 +free_old:
 247 +       MFREE(osh, old, SROM_MAXW);
 248 +       return rc;
 249  }
 250
 251  #if defined(BCMUSBDEV)
 252 --- a/driver/linux_osl.c
 253 +++ b/driver/linux_osl.c
 254 @@ -600,20 +600,29 @@ int
 255  osl_printf(const char *format, ...)
 256  {
 257         va_list args;
 258 -       char buf[1024];
 259 +       char *buf;
 260         int len;
 261
 262 +       buf = kcalloc(1024, sizeof(*buf), GFP_KERNEL);
 263 +       if (!buf)
 264 +               return (-ENOMEM);
 265 +
 266         /* sprintf into a local buffer because there *is* no "vprintk()".. */
 267         va_start(args, format);
 268         len = vsnprintf(buf, 1024, format, args);
 269         va_end(args);
 270
 271 -       if (len > sizeof(buf)) {
 272 +       if (len > (sizeof(*buf) * 1024)) {
 273                 printk("osl_printf: buffer overrun\n");
 274 -               return (0);
 275 +               goto exit;
 276         }
 277
 278 -       return (printk(buf));
 279 +       printk(buf);
 280 +
 281 +exit:
 282 +       kfree(buf);
 283 +
 284 +       return (0);
 285  }
 286
 287  int
 288 --- a/driver/bcmutils.c
 289 +++ b/driver/bcmutils.c
 290 @@ -13,6 +13,7 @@
 291
 292  #include <typedefs.h>
 293  #include <bcmdefs.h>
 294 +#define __need___va_list
 295  #include <stdarg.h>
 296  #include <bcmutils.h>
 297  #ifdef BCMDRIVER