[PATCH] orinoco: Change orinoco_translate_scan() to return error code on error.

Signed-off-by: Pavel Roskin <proski@gnu.org>

diff-tree 8fc038ec51acf5f777fade80c5e38112b766aeee (from ca955293cdfd3139e150d3b4fed3922a7eb651fb)
Author: Pavel Roskin <proski@gnu.org>
Date:   Thu Sep 1 19:10:12 2005 -0400

    Change orinoco_translate_scan() to return error code on error.
    Adjust the caller to check for errors and clean up if needed.
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

drivers/net/wireless/orinoco.c

@@ -4021,7 +4021,8 @@ static int orinoco_ioctl_setscan(struct net_device *dev,
 }
 
 /* Translate scan data returned from the card to a card independant
- * format that the Wireless Tools will understand - Jean II */
+ * format that the Wireless Tools will understand - Jean II
+ * Return message length or -errno for fatal errors */
 static inline int orinoco_translate_scan(struct net_device *dev,
 					 char *buffer,
 					 char *scan,
@@ -4061,13 +4062,19 @@ static inline int orinoco_translate_scan(struct net_device *dev,
 		break;
 	case FIRMWARE_TYPE_INTERSIL:
 		offset = 4;
-		if (priv->has_hostscan)
-			atom_len = scan[0] + (scan[1] << 8);
-		else
+		if (priv->has_hostscan) {
+			atom_len = le16_to_cpup((u16 *)scan);
+			/* Sanity check for atom_len */
+			if (atom_len < sizeof(struct prism2_scan_apinfo)) {
+				printk(KERN_ERR "%s: Invalid atom_len in scan data: %d\n",
+				dev->name, atom_len);
+				return -EIO;
+			}
+		} else
 			atom_len = offsetof(struct prism2_scan_apinfo, atim);
 		break;
 	default:
-		return 0;
+		return -EOPNOTSUPP;
 	}
 
 	/* Check that we got an whole number of atoms */
@@ -4075,7 +4082,7 @@ static inline int orinoco_translate_scan(struct net_device *dev,
 		printk(KERN_ERR "%s: Unexpected scan data length %d, "
 		       "atom_len %d, offset %d\n", dev->name, scan_len,
 		       atom_len, offset);
-		return 0;
+		return -EIO;
 	}
 
 	/* Read the entries one by one */
@@ -4210,16 +4217,20 @@ static int orinoco_ioctl_getscan(struct net_device *dev,
 		/* We have some results to push back to user space */
 
 		/* Translate to WE format */
-		srq->length = orinoco_translate_scan(dev, extra,
+		int ret = orinoco_translate_scan(dev, extra,
 						 priv->scan_result,
 						 priv->scan_len);
 
+		if (ret < 0) {
+			err = ret;
+			kfree(priv->scan_result);
+			priv->scan_result = NULL;
+		} else {
+			srq->length = ret;
+
 			/* Return flags */
 			srq->flags = (__u16) priv->scan_mode;
 
-		/* Results are here, so scan no longer in progress */
-		priv->scan_inprogress = 0;
-
 			/* In any case, Scan results will be cleaned up in the
 			 * reset function and when exiting the driver.
 			 * The person triggering the scanning may never come to
@@ -4239,6 +4250,10 @@ static int orinoco_ioctl_getscan(struct net_device *dev,
 			 * we may want to clean up scan results... - Jean II */
 		}
 
+		/* Scan is no longer in progress */
+		priv->scan_inprogress = 0;
+	}
+	  
 	orinoco_unlock(priv, &flags);
 	return err;
 }