1 files changed, 39 insertions, 29 deletions

diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index e3ea4b346889..5847d6d0881e 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -42,8 +42,12 @@
 
 static void usbctrl_async_callback(struct urb *urb)
 {
-        if (urb)
-                kfree(urb->context);
+        if (urb) {
+                /* free dr */
+                kfree(urb->setup_packet);
+                /* free databuf */
+                kfree(urb->transfer_buffer);
+        }
 }
 
 static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request,
@@ -55,39 +59,47 @@ static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request,
         u8 reqtype;
         struct usb_ctrlrequest *dr;
         struct urb *urb;
-        struct rtl819x_async_write_data {
-                u8 data[REALTEK_USB_VENQT_MAX_BUF_SIZE];
-                struct usb_ctrlrequest dr;
-        } *buf;
+        const u16 databuf_maxlen = REALTEK_USB_VENQT_MAX_BUF_SIZE;
+        u8 *databuf;
+
+        if (WARN_ON_ONCE(len > databuf_maxlen))
+                len = databuf_maxlen;
 
         pipe = usb_sndctrlpipe(udev, 0); /* write_out */
         reqtype =  REALTEK_USB_VENQT_WRITE;
 
-        buf = kmalloc(sizeof(*buf), GFP_ATOMIC);
-        if (!buf)
+        dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
+        if (!dr)
                 return -ENOMEM;
 
+        databuf = kmalloc(databuf_maxlen, GFP_ATOMIC);
+        if (!databuf) {
+                kfree(dr);
+                return -ENOMEM;
+        }
+
         urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urb) {
-                kfree(buf);
+                kfree(databuf);
+                kfree(dr);
                 return -ENOMEM;
         }
 
-        dr = &buf->dr;
-
         dr->bRequestType = reqtype;
         dr->bRequest = request;
         dr->wValue = cpu_to_le16(value);
         dr->wIndex = cpu_to_le16(index);
         dr->wLength = cpu_to_le16(len);
         /* data are already in little-endian order */
-        memcpy(buf, pdata, len);
+        memcpy(databuf, pdata, len);
         usb_fill_control_urb(urb, udev, pipe,
-                             (unsigned char *)dr, buf, len,
-                             usbctrl_async_callback, buf);
+                             (unsigned char *)dr, databuf, len,
+                             usbctrl_async_callback, NULL);
         rc = usb_submit_urb(urb, GFP_ATOMIC);
-        if (rc < 0)
-                kfree(buf);
+        if (rc < 0) {
+                kfree(databuf);
+                kfree(dr);
+        }
         usb_free_urb(urb);
         return rc;
 }
@@ -210,17 +222,16 @@ static void _usb_writeN_sync(struct rtl_priv *rtlpriv, u32 addr, void *data,
         u16 index = REALTEK_USB_VENQT_CMD_IDX;
         int pipe = usb_sndctrlpipe(udev, 0); /* write_out */
         u8 *buffer;
-        dma_addr_t dma_addr;
 
-        wvalue = (u16)(addr&0x0000ffff);
-        buffer = usb_alloc_coherent(udev, (size_t)len, GFP_ATOMIC, &dma_addr);
+        wvalue = (u16)(addr & 0x0000ffff);
+        buffer = kmalloc(len, GFP_ATOMIC);
         if (!buffer)
                 return;
         memcpy(buffer, data, len);
         usb_control_msg(udev, pipe, request, reqtype, wvalue,
                         index, buffer, len, 50);
 
-        usb_free_coherent(udev, (size_t)len, buffer, dma_addr);
+        kfree(buffer);
 }
 
 static void _rtl_usb_io_handler_init(struct device *dev,
@@ -543,8 +554,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         WARN_ON(skb_queue_empty(&rx_queue));
         while (!skb_queue_empty(&rx_queue)) {
                 _skb = skb_dequeue(&rx_queue);
-                _rtl_usb_rx_process_agg(hw, skb);
-                ieee80211_rx_irqsafe(hw, skb);
+                _rtl_usb_rx_process_agg(hw, _skb);
+                ieee80211_rx_irqsafe(hw, _skb);
         }
 }
 
@@ -640,6 +651,7 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
                         RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
                                  "Failed to prep_rx_urb!!\n");
                         err = PTR_ERR(skb);
+                        usb_free_urb(urb);
                         goto err_out;
                 }
 
@@ -825,8 +837,6 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
         u32 ep_num;
         struct urb *_urb = NULL;
         struct sk_buff *_skb = NULL;
-        struct sk_buff_head *skb_list;
-        struct usb_anchor *urb_list;
 
         WARN_ON(NULL == rtlusb->usb_tx_aggregate_hdl);
         if (unlikely(IS_USB_STOP(rtlusb))) {
@@ -836,15 +846,14 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
         ep_num = rtlusb->ep_map.ep_mapping[qnum];
-        skb_list = &rtlusb->tx_skb_queue[ep_num];
         _skb = skb;
         _urb = _rtl_usb_tx_urb_setup(hw, _skb, ep_num);
         if (unlikely(!_urb)) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "Can't allocate urb. Drop skb!\n");
+                kfree_skb(skb);
                 return;
         }
-        urb_list = &rtlusb->tx_pending[ep_num];
         _rtl_submit_tx_urb(hw, _urb);
 }
 
@@ -940,8 +949,9 @@ static struct rtl_intf_ops rtl_usb_ops = {
         .waitq_insert = rtl_usb_tx_chk_waitq_insert,
 };
 
-int __devinit rtl_usb_probe(struct usb_interface *intf,
-                        const struct usb_device_id *id)
+int rtl_usb_probe(struct usb_interface *intf,
+                  const struct usb_device_id *id,
+                  struct rtl_hal_cfg *rtl_hal_cfg)
 {
         int err;
         struct ieee80211_hw *hw = NULL;
@@ -976,7 +986,7 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
         usb_set_intfdata(intf, hw);
         /* init cfg & intf_ops */
         rtlpriv->rtlhal.interface = INTF_USB;
-        rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_info);
+        rtlpriv->cfg = rtl_hal_cfg;
         rtlpriv->intf_ops = &rtl_usb_ops;
         rtl_dbgp_flag_init(hw);
         /* Init IO handler */