From f12d5d13d449e97b30da17a5c5f3ed3ea225cee9 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oliver@neukum.org>
Date: Thu, 18 Dec 2008 13:16:40 +0100
Subject: [PATCH] --- yaml --- r: 126628 b: refs/heads/master c:
 0d1d1424330cc1934f2b2742f0cfa2c31e6a250b h: refs/heads/master v: v3

---
 [refs]                                    |  2 +-
 trunk/drivers/staging/at76_usb/at76_usb.c | 26 +++++++++++++++++------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/[refs] b/[refs]
index 378de261b5f6..b85622c636e8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 66664462909d9c62bcff3dceb579b438563f15ee
+refs/heads/master: 0d1d1424330cc1934f2b2742f0cfa2c31e6a250b
diff --git a/trunk/drivers/staging/at76_usb/at76_usb.c b/trunk/drivers/staging/at76_usb/at76_usb.c
index 375ba7cc3006..c68d2279d495 100644
--- a/trunk/drivers/staging/at76_usb/at76_usb.c
+++ b/trunk/drivers/staging/at76_usb/at76_usb.c
@@ -590,18 +590,25 @@ static int at76_remap(struct usb_device *udev)
 static int at76_get_op_mode(struct usb_device *udev)
 {
 	int ret;
-	u8 op_mode;
+	u8 saved;
+	u8 *op_mode;
 
+	op_mode = kmalloc(1, GFP_NOIO);
+	if (!op_mode)
+		return -ENOMEM;
 	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
 			      USB_TYPE_VENDOR | USB_DIR_IN |
 			      USB_RECIP_INTERFACE, 0x01, 0, &op_mode, 1,
 			      USB_CTRL_GET_TIMEOUT);
+	saved = *op_mode;
+	kfree(op_mode);
+
 	if (ret < 0)
 		return ret;
 	else if (ret < 1)
 		return -EIO;
 	else
-		return op_mode;
+		return saved;
 }
 
 /* Load a block of the second ("external") part of the firmware */
@@ -714,17 +721,22 @@ static inline int at76_get_mib(struct usb_device *udev, u16 mib, void *buf,
 /* Return positive number for status, negative for an error */
 static inline int at76_get_cmd_status(struct usb_device *udev, u8 cmd)
 {
-	u8 stat_buf[40];
+	u8 *stat_buf;
 	int ret;
 
+	stat_buf = kmalloc(40, GFP_NOIO);
+	if (!stat_buf)
+		return -ENOMEM;
+
 	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x22,
 			      USB_TYPE_VENDOR | USB_DIR_IN |
 			      USB_RECIP_INTERFACE, cmd, 0, stat_buf,
 			      sizeof(stat_buf), USB_CTRL_GET_TIMEOUT);
-	if (ret < 0)
-		return ret;
+	if (ret >= 0)
+		ret = stat_buf[5];
+	kfree(stat_buf);
 
-	return stat_buf[5];
+	return ret;
 }
 
 #define MAKE_CMD_CASE(c) case (c): return #c
@@ -745,7 +757,7 @@ static const char *at76_get_cmd_string(u8 cmd_status)
 	return "UNKNOWN";
 }
 
-static int at76_set_card_command(struct usb_device *udev, int cmd, void *buf,
+static int at76_set_card_command(struct usb_device *udev, u8 cmd, void *buf,
 				 int buf_size)
 {
 	int ret;