Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

[net-next-2.6.git] / drivers / net / wireless / rt2x00 / rt2x00debug.c

diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index cea81e4c5c82d7b40c9a6987f36b749b9c69ecc7..fcdb6b0dc40f88d4e90ca5a064a70e6516cc6f30 100644 (file)
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -334,12 +334,12 @@ static ssize_t rt2x00debug_read_queue_stats(struct file *file,
        if (*offset)
                return 0;
 
-       data = kzalloc(lines * MAX_LINE_LENGTH, GFP_KERNEL);
+       data = kcalloc(lines, MAX_LINE_LENGTH, GFP_KERNEL);
        if (!data)
                return -ENOMEM;
 
        temp = data +
-           sprintf(data, "qid\tcount\tlimit\tlength\tindex\tdone\tcrypto\n");
+           sprintf(data, "qid\tcount\tlimit\tlength\tindex\tdma done\tdone\n");
 
        queue_for_each(intf->rt2x00dev, queue) {
                spin_lock_irqsave(&queue->lock, irqflags);
@@ -347,8 +347,8 @@ static ssize_t rt2x00debug_read_queue_stats(struct file *file,
                temp += sprintf(temp, "%d\t%d\t%d\t%d\t%d\t%d\t%d\n", queue->qid,
                                queue->count, queue->limit, queue->length,
                                queue->index[Q_INDEX],
-                               queue->index[Q_INDEX_DONE],
-                               queue->index[Q_INDEX_CRYPTO]);
+                               queue->index[Q_INDEX_DMA_DONE],
+                               queue->index[Q_INDEX_DONE]);
 
                spin_unlock_irqrestore(&queue->lock, irqflags);
        }
@@ -382,7 +382,7 @@ static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
                                             loff_t *offset)
 {
        struct rt2x00debug_intf *intf = file->private_data;
-       char *name[] = { "WEP64", "WEP128", "TKIP", "AES" };
+       static const char * const name[] = { "WEP64", "WEP128", "TKIP", "AES" };
        char *data;
        char *temp;
        size_t size;
@@ -484,6 +484,9 @@ static ssize_t rt2x00debug_write_##__name(struct file *file,        \
        if (index >= debug->__name.word_count)                  \
                return -EINVAL;                                 \
                                                                \
+       if (length > sizeof(line))                              \
+               return -EINVAL;                                 \
+                                                               \
        if (copy_from_user(line, buf, length))                  \
                return -EFAULT;                                 \
                                                                \