diff options
Diffstat (limited to 'drivers/pcmcia/cistpl.c')
-rw-r--r-- | drivers/pcmcia/cistpl.c | 21 |
1 files changed, 11 insertions, 10 deletions
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c index 65129b54eb09..fe789e0e7ada 100644 --- a/drivers/pcmcia/cistpl.c +++ b/drivers/pcmcia/cistpl.c | |||
@@ -92,7 +92,8 @@ set_cis_map(struct pcmcia_socket *s, unsigned int card_offset, unsigned int flag | |||
92 | if (!(s->features & SS_CAP_STATIC_MAP) && (mem->res == NULL)) { | 92 | if (!(s->features & SS_CAP_STATIC_MAP) && (mem->res == NULL)) { |
93 | mem->res = pcmcia_find_mem_region(0, s->map_size, s->map_size, 0, s); | 93 | mem->res = pcmcia_find_mem_region(0, s->map_size, s->map_size, 0, s); |
94 | if (mem->res == NULL) { | 94 | if (mem->res == NULL) { |
95 | printk(KERN_NOTICE "cs: unable to map card memory!\n"); | 95 | dev_printk(KERN_NOTICE, &s->dev, |
96 | "cs: unable to map card memory!\n"); | ||
96 | return NULL; | 97 | return NULL; |
97 | } | 98 | } |
98 | s->cis_virt = NULL; | 99 | s->cis_virt = NULL; |
@@ -265,13 +266,13 @@ EXPORT_SYMBOL(pcmcia_write_cis_mem); | |||
265 | ======================================================================*/ | 266 | ======================================================================*/ |
266 | 267 | ||
267 | static void read_cis_cache(struct pcmcia_socket *s, int attr, u_int addr, | 268 | static void read_cis_cache(struct pcmcia_socket *s, int attr, u_int addr, |
268 | u_int len, void *ptr) | 269 | size_t len, void *ptr) |
269 | { | 270 | { |
270 | struct cis_cache_entry *cis; | 271 | struct cis_cache_entry *cis; |
271 | int ret; | 272 | int ret; |
272 | 273 | ||
273 | if (s->fake_cis) { | 274 | if (s->fake_cis) { |
274 | if (s->fake_cis_len > addr+len) | 275 | if (s->fake_cis_len >= addr+len) |
275 | memcpy(ptr, s->fake_cis+addr, len); | 276 | memcpy(ptr, s->fake_cis+addr, len); |
276 | else | 277 | else |
277 | memset(ptr, 0xff, len); | 278 | memset(ptr, 0xff, len); |
@@ -380,17 +381,17 @@ int verify_cis_cache(struct pcmcia_socket *s) | |||
380 | 381 | ||
381 | ======================================================================*/ | 382 | ======================================================================*/ |
382 | 383 | ||
383 | int pcmcia_replace_cis(struct pcmcia_socket *s, cisdump_t *cis) | 384 | int pcmcia_replace_cis(struct pcmcia_socket *s, |
385 | const u8 *data, const size_t len) | ||
384 | { | 386 | { |
385 | kfree(s->fake_cis); | 387 | if (len > CISTPL_MAX_CIS_SIZE) |
386 | s->fake_cis = NULL; | ||
387 | if (cis->Length > CISTPL_MAX_CIS_SIZE) | ||
388 | return CS_BAD_SIZE; | 388 | return CS_BAD_SIZE; |
389 | s->fake_cis = kmalloc(cis->Length, GFP_KERNEL); | 389 | kfree(s->fake_cis); |
390 | s->fake_cis = kmalloc(len, GFP_KERNEL); | ||
390 | if (s->fake_cis == NULL) | 391 | if (s->fake_cis == NULL) |
391 | return CS_OUT_OF_RESOURCE; | 392 | return CS_OUT_OF_RESOURCE; |
392 | s->fake_cis_len = cis->Length; | 393 | s->fake_cis_len = len; |
393 | memcpy(s->fake_cis, cis->Data, cis->Length); | 394 | memcpy(s->fake_cis, data, len); |
394 | return CS_SUCCESS; | 395 | return CS_SUCCESS; |
395 | } | 396 | } |
396 | EXPORT_SYMBOL(pcmcia_replace_cis); | 397 | EXPORT_SYMBOL(pcmcia_replace_cis); |