Merge master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh64-2.6

[sfrench/cifs-2.6.git] / drivers / char / pcmcia / cm4040_cs.c

diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 0e82968c2f38ee74c30e6c0a779f365d2c5f5a52..b24a3e7bbb9f23b409a77dfb2ffc4ff93a0c9f26 100644 (file)
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -273,6 +273,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
        DEBUGP(6, dev, "BytesToRead=%lu\n", bytes_to_read);
 
        min_bytes_to_read = min(count, bytes_to_read + 5);
+       min_bytes_to_read = min_t(size_t, min_bytes_to_read, READ_WRITE_BUFFER_SIZE);
 
        DEBUGP(6, dev, "Min=%lu\n", min_bytes_to_read);
 
@@ -340,7 +341,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                return 0;
        }
 
-       if (count < 5) {
+       if ((count < 5) || (count > READ_WRITE_BUFFER_SIZE)) {
                DEBUGP(2, dev, "<- cm4040_write buffersize=%Zd < 5\n", count);
                return -EIO;
        }
@@ -598,7 +599,7 @@ cs_release:
 
 static void reader_release(struct pcmcia_device *link)
 {
-       cm4040_reader_release(link->priv);
+       cm4040_reader_release(link);
        pcmcia_disable_device(link);
 }
 
@@ -635,8 +636,11 @@ static int reader_probe(struct pcmcia_device *link)
        setup_timer(&dev->poll_timer, cm4040_do_poll, 0);
 
        ret = reader_config(link, i);
-       if (ret)
+       if (ret) {
+               dev_table[i] = NULL;
+               kfree(dev);
                return ret;
+       }
 
        class_device_create(cmx_class, NULL, MKDEV(major, i), NULL,
                            "cmx%d", i);
@@ -707,12 +711,14 @@ static int __init cm4040_init(void)
        if (major < 0) {
                printk(KERN_WARNING MODULE_NAME
                        ": could not get major number\n");
+               class_destroy(cmx_class);
                return major;
        }
 
        rc = pcmcia_register_driver(&reader_driver);
        if (rc < 0) {
                unregister_chrdev(major, DEVICE_NAME);
+               class_destroy(cmx_class);
                return rc;
        }