This commit was manufactured by cvs2svn to create tag

[linux-2.6.git] / drivers / usb / class / bluetty.c

diff --git a/drivers/usb/class/bluetty.c b/drivers/usb/class/bluetty.c
index 6585faa..4d8e018 100644 (file)
--- a/drivers/usb/class/bluetty.c
+++ b/drivers/usb/class/bluetty.c
@@ -207,7 +207,7 @@ struct usb_bluetooth {
 /* local function prototypes */
 static int  bluetooth_open             (struct tty_struct *tty, struct file *filp);
 static void bluetooth_close            (struct tty_struct *tty, struct file *filp);
-static int  bluetooth_write            (struct tty_struct *tty, const unsigned char *buf, int count);
+static int  bluetooth_write            (struct tty_struct *tty, int from_user, const unsigned char *buf, int count);
 static int  bluetooth_write_room       (struct tty_struct *tty);
 static int  bluetooth_chars_in_buffer  (struct tty_struct *tty);
 static void bluetooth_throttle         (struct tty_struct *tty);
@@ -426,14 +426,14 @@ static void bluetooth_close (struct tty_struct *tty, struct file * filp)
                bluetooth->open_count = 0;
 
                /* shutdown any in-flight urbs that we know about */
-               usb_kill_urb (bluetooth->read_urb);
-               usb_kill_urb (bluetooth->interrupt_in_urb);
+               usb_unlink_urb (bluetooth->read_urb);
+               usb_unlink_urb (bluetooth->interrupt_in_urb);
        }
        up(&bluetooth->lock);
 }
 
 
-static int bluetooth_write (struct tty_struct * tty, const unsigned char *buf, int count)
+static int bluetooth_write (struct tty_struct * tty, int from_user, const unsigned char *buf, int count)
 {
        struct usb_bluetooth *bluetooth = get_usb_bluetooth ((struct usb_bluetooth *)tty->driver_data, __FUNCTION__);
        struct urb *urb = NULL;
@@ -471,7 +471,21 @@ static int bluetooth_write (struct tty_struct * tty, const unsigned char *buf, i
        printk ("\n");
 #endif
 
-       current_buffer = buf;
+       if (from_user) {
+               temp_buffer = kmalloc (count, GFP_KERNEL);
+               if (temp_buffer == NULL) {
+                       err ("%s - out of memory.", __FUNCTION__);
+                       retval = -ENOMEM;
+                       goto exit;
+               }
+               if (copy_from_user (temp_buffer, (void __user *)buf, count)) {
+                       retval = -EFAULT;
+                       goto exit;
+               }
+               current_buffer = temp_buffer;
+       } else {
+               current_buffer = buf;
+       }
 
        switch (*current_buffer) {
                /* First byte indicates the type of packet */
@@ -691,7 +705,7 @@ void btusb_disable_bulk_read(struct tty_struct *tty){
        }
 
        if ((bluetooth->read_urb) && (bluetooth->read_urb->actual_length))
-               usb_kill_urb(bluetooth->read_urb);
+               usb_unlink_urb(bluetooth->read_urb);
 }
 #endif
 
@@ -1165,14 +1179,14 @@ static void usb_bluetooth_disconnect(struct usb_interface *intf)
                bluetooth->open_count = 0;
 
                if (bluetooth->read_urb) {
-                       usb_kill_urb (bluetooth->read_urb);
+                       usb_unlink_urb (bluetooth->read_urb);
                        usb_free_urb (bluetooth->read_urb);
                }
                if (bluetooth->bulk_in_buffer)
                        kfree (bluetooth->bulk_in_buffer);
 
                if (bluetooth->interrupt_in_urb) {
-                       usb_kill_urb (bluetooth->interrupt_in_urb);
+                       usb_unlink_urb (bluetooth->interrupt_in_urb);
                        usb_free_urb (bluetooth->interrupt_in_urb);
                }
                if (bluetooth->interrupt_in_buffer)
@@ -1182,7 +1196,7 @@ static void usb_bluetooth_disconnect(struct usb_interface *intf)
 
                for (i = 0; i < NUM_CONTROL_URBS; ++i) {
                        if (bluetooth->control_urb_pool[i]) {
-                               usb_kill_urb (bluetooth->control_urb_pool[i]);
+                               usb_unlink_urb (bluetooth->control_urb_pool[i]);
                                if (bluetooth->control_urb_pool[i]->transfer_buffer)
                                        kfree (bluetooth->control_urb_pool[i]->transfer_buffer);
                                usb_free_urb (bluetooth->control_urb_pool[i]);