If the usermode app does an ioctl over this serial device  by
using TIOCMIWAIT, then the code will wait by setting the current
task state to TASK_INTERRUPTIBLE and then calling schedule().
This will be woken up by the qt2_process_modem_status on URB
completion when the port_extra->shadowMSR is set to the new
modem status.

However, this could result in a lost wakeup scenario due to a race
in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion
for new modem status in qt2_process_modem_status.
Due to this, the usermode app's task will continue to sleep despite a
change in the modem status.
Signed-off-by: NKautuk Consul <consul.kautuk@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In the first alteration, the MAX_CNTL_PKT_SIZE is the
maximum size of the control packet in ->Adapter->txctlpacket[]
which is defined in InitAdapter(). This caps the size of
kmalloc memory allocation. In the second change, this max
cap fixes a potential memory corruption bug when subsequent
memset and memcpy calls are invoked.
Signed-off-by: NKevin McKinney <klmckinney1@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If IoBuffer.InputLength is zero then this will cause an Oops when
we dereference the ZERO_SIZE_PTR.  Or if it's smaller than
sizeof(struct link_request) then we would get memory corruption
when we set ->PLength in CopyBufferToControlPacket().
Signed-off-by: NKevin McKinney <klmckinney1@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Revert changes in definitions that were submitted on May 11 2011 and
committed on June 7 2011. No reason for the change in these values was
given in the patch comment, it broke compatibility with older
versions, and was difficult to detect by the simultaneous move of the
lines of code.
Signed-off-by: NAlexander Thomas <alexander.thomas@esaturnus.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Structure that is received from dongle has been annotated.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Several global variables that were set but never initialized have
been removed.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The source file contained some static global variables that were
needed per device handled by the driver. They have moved to the
struct brcmf_sdio_dev for that reason.
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The macro was only used once in the code and has been removed for
clarity reading the code.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The brcmfmac had a module parameter which could be used to override
the name of the wireless net device name and it defaults to 'wlan'.
This is considered rather useless, because what is in a name.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use macro to replace global variable for ARP offload configuration
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

_brcmf_sysioc_thread is handling deferred jobs from 4 callers. Use
work queue to handle set_mac_address/set_multicast_list requests.
brcmf_add_if/brcmf_del_if never run in atomic context and can call
brcmf_op_if directly.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Structure that is sent to the dongle has been annotated.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Structure that is sent to the dongle has been annotated.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Structures that are sent to the dongle have been annotated.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Three structures that are sent to the dongle have been annotated for correct
endianness:  struct brcmf_iscan_params, brcmf_scan_params,
brcmf_cfg80211_scan_req.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

brcmf_dev_ioctl() does not provide a user space buffer to
brcmf_netdev_ioctl_priv. Hence these calls are not necessary.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Removed a function parameter since it was redundant.
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove unnecessary global variable
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove unnecessary global variable
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use constant values for packet filter configuration
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove brcmf_deferred_tx as it should be always 1
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Replaced the global variable with macro.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Dead code removal.
Reviewed-by: NRoland Vossen <rvossen@broadcom.com>
Reviewed-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Sizeof a pointer-typed expression returns the size of the pointer, not that
of the pointed data.

The semantic patch that fixes this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression *e;
type T;
identifier f;
@@

f(...,(T)e,...,
-sizeof(e)
+sizeof(*e)
,...)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix long function prototypes and line up arguments nicely.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix indent of function arguments.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Line up integer constant with others.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Replace :? operator by equivalent if-else statement where in improves
readability. Don't add else branch if it is not needed.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Delete braces around single statements.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change indent with spaces to tabs.
Signed-off-by: NLeonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>