dbg("numbytes to read = %d", numbytes);
dbg("endpoint # %d", ctrl->endpoint);
- if (copy_from_user(uBuf, ctrl->pData, numbytes))
+ if (copy_from_user(uBuf, ctrl->pData, numbytes)) {
dbg("copying ctrl->pData to dummyBuf failed");
+ return -EFAULT;
+ }
do {
i = usb_bulk_msg(pdx->udev, pdx->hEP[ctrl->endpoint],
}
switch (cmd) {
case PIUSB_GETVNDCMD:
- if (copy_from_user
- (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct)))
+ if (__copy_from_user
+ (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct))) {
dev_err(&pdx->udev->dev, "copy_from_user failed\n");
+ return -EFAULT;
+ }
dbg("%s %x\n", "Get Vendor Command = ", ctrl.cmd);
retval =
usb_control_msg(pdx->udev, usb_rcvctrlpipe(pdx->udev, 0),
return retval;
case PIUSB_SETVNDCMD:
- if (copy_from_user
- (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct)))
+ if (__copy_from_user
+ (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct))) {
dev_err(&pdx->udev->dev, "copy_from_user failed\n");
+ return -EFAULT;
+ }
/* dbg( "%s %x", "Set Vendor Command = ",ctrl.cmd ); */
controlData = ctrl.pData[0];
controlData |= (ctrl.pData[1] << 8);
return ((pdx->udev->speed == USB_SPEED_HIGH) ? 1 : 0);
case PIUSB_WRITEPIPE:
- if (copy_from_user(&ctrl, (void __user *)arg, _IOC_SIZE(cmd)))
+ if (__copy_from_user(&ctrl, (void __user *)arg, _IOC_SIZE(cmd))) {
dev_err(&pdx->udev->dev,
"copy_from_user WRITE_DUMMY failed\n");
+ return -EFAULT;
+ }
if (!access_ok(VERIFY_READ, ctrl.pData, ctrl.numbytes)) {
dbg("can't access pData");
return 0;
return ctrl.numbytes;
case PIUSB_USERBUFFER:
- if (copy_from_user
- (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct)))
+ if (__copy_from_user
+ (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct))) {
dev_err(&pdx->udev->dev, "copy_from_user failed\n");
+ return -EFAULT;
+ }
return MapUserBuffer((struct ioctl_struct *) &ctrl, pdx);
case PIUSB_UNMAP_USERBUFFER:
return retval;
case PIUSB_READPIPE:
- if (copy_from_user(&ctrl, (void __user *)arg,
- sizeof(struct ioctl_struct)))
+ if (__copy_from_user(&ctrl, (void __user *)arg,
+ sizeof(struct ioctl_struct))) {
dev_err(&pdx->udev->dev, "copy_from_user failed\n");
-
+ return -EFAULT;
+ }
if (((0 == ctrl.endpoint) && (PIXIS_PID == pdx->iama)) ||
(1 == ctrl.endpoint) || /* ST133IO */
(4 == ctrl.endpoint)) /* PIXIS IO */
case PIUSB_SETFRAMESIZE:
dbg("PIUSB_SETFRAMESIZE");
- if (copy_from_user
- (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct)))
+ if (__copy_from_user
+ (&ctrl, (void __user *)arg, sizeof(struct ioctl_struct))) {
dev_err(&pdx->udev->dev, "copy_from_user failed\n");
+ return -EFAULT;
+ }
pdx->frameSize = ctrl.numbytes;
pdx->num_frames = ctrl.numFrames;
if (!pdx->sgl)
__func__, status);
pdx->pendingWrite = 0;
- usb_buffer_free(urb->dev, urb->transfer_buffer_length,
- urb->transfer_buffer, urb->transfer_dma);
+ kfree(urb->transfer_buffer);
}
int piusb_output(struct ioctl_struct *io, unsigned char *uBuf, int len,
urb = usb_alloc_urb(0, GFP_KERNEL);
if (urb != NULL) {
- kbuf =
- usb_buffer_alloc(pdx->udev, len, GFP_KERNEL,
- &urb->transfer_dma);
+ kbuf = kmalloc(len, GFP_KERNEL);
if (!kbuf) {
dev_err(&pdx->udev->dev, "buffer_alloc failed\n");
return -ENOMEM;
}
- memcpy(kbuf, uBuf, len);
+ if(__copy_from_user(kbuf, uBuf, len)) {
+ dev_err(&pdx->udev->dev, "__copy_from_user failed\n");
+ return -EFAULT;
+ }
usb_fill_bulk_urb(urb, pdx->udev, pdx->hEP[io->endpoint], kbuf,
len, piusb_write_bulk_callback, pdx);
- urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
err = usb_submit_urb(urb, GFP_KERNEL);
if (err) {
dev_err(&pdx->udev->dev,
numPagesRequired =
((uaddr & ~PAGE_MASK) + count + ~PAGE_MASK) >> PAGE_SHIFT;
dbg("Number of pages needed = %d", numPagesRequired);
- maplist_p = vmalloc(numPagesRequired * sizeof(struct page));
+ maplist_p = vmalloc(numPagesRequired * sizeof(struct page *));
if (!maplist_p) {
dbg("Can't Allocate Memory for maplist_p");
return -ENOMEM;
usb_fill_bulk_urb(pdx->PixelUrb[frameInfo][i],
pdx->udev,
epAddr,
- (dma_addr_t *) sg_dma_address(&pdx->
- sgl[frameInfo]
- [i]),
+ NULL, // non-DMA HC? buy a better hardware
sg_dma_len(&pdx->sgl[frameInfo][i]),
piusb_readPIXEL_callback, (void *)pdx);
pdx->PixelUrb[frameInfo][i]->transfer_dma =