X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=drivers%2Fusb%2Fclass%2Fbluetty.c;h=4d8e01895ce93d896e860e049118e67186e0d608;hb=6f71f83334a552167ccbbd42fe5dd979428c89e4;hp=6585faa2882d5327194bfff6a042a8c97f9db8a3;hpb=8d40237c730b8be87c1b80a5d96b9c603fefa829;p=linux-2.6.git

diff --git a/drivers/usb/class/bluetty.c b/drivers/usb/class/bluetty.c
index 6585faa28..4d8e01895 100644
--- a/drivers/usb/class/bluetty.c
+++ b/drivers/usb/class/bluetty.c
@@ -207,7 +207,7 @@ struct usb_bluetooth {
 /* local function prototypes */
 static int  bluetooth_open		(struct tty_struct *tty, struct file *filp);
 static void bluetooth_close		(struct tty_struct *tty, struct file *filp);
-static int  bluetooth_write		(struct tty_struct *tty, const unsigned char *buf, int count);
+static int  bluetooth_write		(struct tty_struct *tty, int from_user, const unsigned char *buf, int count);
 static int  bluetooth_write_room	(struct tty_struct *tty);
 static int  bluetooth_chars_in_buffer	(struct tty_struct *tty);
 static void bluetooth_throttle		(struct tty_struct *tty);
@@ -426,14 +426,14 @@ static void bluetooth_close (struct tty_struct *tty, struct file * filp)
 		bluetooth->open_count = 0;
 
 		/* shutdown any in-flight urbs that we know about */
-		usb_kill_urb (bluetooth->read_urb);
-		usb_kill_urb (bluetooth->interrupt_in_urb);
+		usb_unlink_urb (bluetooth->read_urb);
+		usb_unlink_urb (bluetooth->interrupt_in_urb);
 	}
 	up(&bluetooth->lock);
 }
 
 
-static int bluetooth_write (struct tty_struct * tty, const unsigned char *buf, int count)
+static int bluetooth_write (struct tty_struct * tty, int from_user, const unsigned char *buf, int count)
 {
 	struct usb_bluetooth *bluetooth = get_usb_bluetooth ((struct usb_bluetooth *)tty->driver_data, __FUNCTION__);
 	struct urb *urb = NULL;
@@ -471,7 +471,21 @@ static int bluetooth_write (struct tty_struct * tty, const unsigned char *buf, i
 	printk ("\n");
 #endif
 
-	current_buffer = buf;
+	if (from_user) {
+		temp_buffer = kmalloc (count, GFP_KERNEL);
+		if (temp_buffer == NULL) {
+			err ("%s - out of memory.", __FUNCTION__);
+			retval = -ENOMEM;
+			goto exit;
+		}
+		if (copy_from_user (temp_buffer, (void __user *)buf, count)) {
+			retval = -EFAULT;
+			goto exit;
+		}
+		current_buffer = temp_buffer;
+	} else {
+		current_buffer = buf;
+	}
 
 	switch (*current_buffer) {
 		/* First byte indicates the type of packet */
@@ -691,7 +705,7 @@ void btusb_disable_bulk_read(struct tty_struct *tty){
 	}
 
 	if ((bluetooth->read_urb) && (bluetooth->read_urb->actual_length))
-		usb_kill_urb(bluetooth->read_urb);
+		usb_unlink_urb(bluetooth->read_urb);
 }
 #endif
 
@@ -1165,14 +1179,14 @@ static void usb_bluetooth_disconnect(struct usb_interface *intf)
 		bluetooth->open_count = 0;
 
 		if (bluetooth->read_urb) {
-			usb_kill_urb (bluetooth->read_urb);
+			usb_unlink_urb (bluetooth->read_urb);
 			usb_free_urb (bluetooth->read_urb);
 		}
 		if (bluetooth->bulk_in_buffer)
 			kfree (bluetooth->bulk_in_buffer);
 
 		if (bluetooth->interrupt_in_urb) {
-			usb_kill_urb (bluetooth->interrupt_in_urb);
+			usb_unlink_urb (bluetooth->interrupt_in_urb);
 			usb_free_urb (bluetooth->interrupt_in_urb);
 		}
 		if (bluetooth->interrupt_in_buffer)
@@ -1182,7 +1196,7 @@ static void usb_bluetooth_disconnect(struct usb_interface *intf)
 
 		for (i = 0; i < NUM_CONTROL_URBS; ++i) {
 			if (bluetooth->control_urb_pool[i]) {
-				usb_kill_urb (bluetooth->control_urb_pool[i]);
+				usb_unlink_urb (bluetooth->control_urb_pool[i]);
 				if (bluetooth->control_urb_pool[i]->transfer_buffer)
 					kfree (bluetooth->control_urb_pool[i]->transfer_buffer);
 				usb_free_urb (bluetooth->control_urb_pool[i]);