diff options
-rw-r--r-- | drivers/usb/net/gl620a.c | 26 | ||||
-rw-r--r-- | drivers/usb/serial/cp2101.c | 8 |
2 files changed, 16 insertions, 18 deletions
diff --git a/drivers/usb/net/gl620a.c b/drivers/usb/net/gl620a.c index a6f0f4d934df..31e5fe363fdc 100644 --- a/drivers/usb/net/gl620a.c +++ b/drivers/usb/net/gl620a.c | |||
@@ -70,12 +70,12 @@ | |||
70 | (((GL_MAX_PACKET_LEN + 4) * GL_MAX_TRANSMIT_PACKETS) + 4) | 70 | (((GL_MAX_PACKET_LEN + 4) * GL_MAX_TRANSMIT_PACKETS) + 4) |
71 | 71 | ||
72 | struct gl_packet { | 72 | struct gl_packet { |
73 | u32 packet_length; | 73 | __le32 packet_length; |
74 | char packet_data [1]; | 74 | char packet_data [1]; |
75 | }; | 75 | }; |
76 | 76 | ||
77 | struct gl_header { | 77 | struct gl_header { |
78 | u32 packet_count; | 78 | __le32 packet_count; |
79 | struct gl_packet packets; | 79 | struct gl_packet packets; |
80 | }; | 80 | }; |
81 | 81 | ||
@@ -85,15 +85,14 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb) | |||
85 | struct gl_packet *packet; | 85 | struct gl_packet *packet; |
86 | struct sk_buff *gl_skb; | 86 | struct sk_buff *gl_skb; |
87 | u32 size; | 87 | u32 size; |
88 | u32 count; | ||
88 | 89 | ||
89 | header = (struct gl_header *) skb->data; | 90 | header = (struct gl_header *) skb->data; |
90 | 91 | ||
91 | // get the packet count of the received skb | 92 | // get the packet count of the received skb |
92 | le32_to_cpus(&header->packet_count); | 93 | count = le32_to_cpu(header->packet_count); |
93 | if ((header->packet_count > GL_MAX_TRANSMIT_PACKETS) | 94 | if (count > GL_MAX_TRANSMIT_PACKETS) { |
94 | || (header->packet_count < 0)) { | 95 | dbg("genelink: invalid received packet count %u", count); |
95 | dbg("genelink: invalid received packet count %d", | ||
96 | header->packet_count); | ||
97 | return 0; | 96 | return 0; |
98 | } | 97 | } |
99 | 98 | ||
@@ -103,7 +102,7 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb) | |||
103 | // decrement the length for the packet count size 4 bytes | 102 | // decrement the length for the packet count size 4 bytes |
104 | skb_pull(skb, 4); | 103 | skb_pull(skb, 4); |
105 | 104 | ||
106 | while (header->packet_count > 1) { | 105 | while (count > 1) { |
107 | // get the packet length | 106 | // get the packet length |
108 | size = le32_to_cpu(packet->packet_length); | 107 | size = le32_to_cpu(packet->packet_length); |
109 | 108 | ||
@@ -124,9 +123,8 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb) | |||
124 | } | 123 | } |
125 | 124 | ||
126 | // advance to the next packet | 125 | // advance to the next packet |
127 | packet = (struct gl_packet *) | 126 | packet = (struct gl_packet *)&packet->packet_data[size]; |
128 | &packet->packet_data [size]; | 127 | count--; |
129 | header->packet_count--; | ||
130 | 128 | ||
131 | // shift the data pointer to the next gl_packet | 129 | // shift the data pointer to the next gl_packet |
132 | skb_pull(skb, size + 4); | 130 | skb_pull(skb, size + 4); |
@@ -149,8 +147,8 @@ genelink_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags) | |||
149 | int length = skb->len; | 147 | int length = skb->len; |
150 | int headroom = skb_headroom(skb); | 148 | int headroom = skb_headroom(skb); |
151 | int tailroom = skb_tailroom(skb); | 149 | int tailroom = skb_tailroom(skb); |
152 | u32 *packet_count; | 150 | __le32 *packet_count; |
153 | u32 *packet_len; | 151 | __le32 *packet_len; |
154 | 152 | ||
155 | // FIXME: magic numbers, bleech | 153 | // FIXME: magic numbers, bleech |
156 | padlen = ((skb->len + (4 + 4*1)) % 64) ? 0 : 1; | 154 | padlen = ((skb->len + (4 + 4*1)) % 64) ? 0 : 1; |
@@ -172,7 +170,7 @@ genelink_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags) | |||
172 | } | 170 | } |
173 | 171 | ||
174 | // attach the packet count to the header | 172 | // attach the packet count to the header |
175 | packet_count = (u32 *) skb_push(skb, (4 + 4*1)); | 173 | packet_count = (__le32 *) skb_push(skb, (4 + 4*1)); |
176 | packet_len = packet_count + 1; | 174 | packet_len = packet_count + 1; |
177 | 175 | ||
178 | *packet_count = cpu_to_le32(1); | 176 | *packet_count = cpu_to_le32(1); |
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c index 06b4fffc189c..3ec24870bca9 100644 --- a/drivers/usb/serial/cp2101.c +++ b/drivers/usb/serial/cp2101.c | |||
@@ -170,13 +170,13 @@ static int cp2101_get_config(struct usb_serial_port* port, u8 request, | |||
170 | unsigned int *data, int size) | 170 | unsigned int *data, int size) |
171 | { | 171 | { |
172 | struct usb_serial *serial = port->serial; | 172 | struct usb_serial *serial = port->serial; |
173 | u32 *buf; | 173 | __le32 *buf; |
174 | int result, i, length; | 174 | int result, i, length; |
175 | 175 | ||
176 | /* Number of integers required to contain the array */ | 176 | /* Number of integers required to contain the array */ |
177 | length = (((size - 1) | 3) + 1)/4; | 177 | length = (((size - 1) | 3) + 1)/4; |
178 | 178 | ||
179 | buf = kcalloc(length, sizeof(u32), GFP_KERNEL); | 179 | buf = kcalloc(length, sizeof(__le32), GFP_KERNEL); |
180 | if (!buf) { | 180 | if (!buf) { |
181 | dev_err(&port->dev, "%s - out of memory.\n", __FUNCTION__); | 181 | dev_err(&port->dev, "%s - out of memory.\n", __FUNCTION__); |
182 | return -ENOMEM; | 182 | return -ENOMEM; |
@@ -216,13 +216,13 @@ static int cp2101_set_config(struct usb_serial_port* port, u8 request, | |||
216 | unsigned int *data, int size) | 216 | unsigned int *data, int size) |
217 | { | 217 | { |
218 | struct usb_serial *serial = port->serial; | 218 | struct usb_serial *serial = port->serial; |
219 | u32 *buf; | 219 | __le32 *buf; |
220 | int result, i, length; | 220 | int result, i, length; |
221 | 221 | ||
222 | /* Number of integers required to contain the array */ | 222 | /* Number of integers required to contain the array */ |
223 | length = (((size - 1) | 3) + 1)/4; | 223 | length = (((size - 1) | 3) + 1)/4; |
224 | 224 | ||
225 | buf = kmalloc(length * sizeof(u32), GFP_KERNEL); | 225 | buf = kmalloc(length * sizeof(__le32), GFP_KERNEL); |
226 | if (!buf) { | 226 | if (!buf) { |
227 | dev_err(&port->dev, "%s - out of memory.\n", | 227 | dev_err(&port->dev, "%s - out of memory.\n", |
228 | __FUNCTION__); | 228 | __FUNCTION__); |