libertas: Fix up error handling in lbs_setuserscan()

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index d3a47cc95475808be4d448ef2a990dd55d7ee17c..b0a76c5bec66abbc9a1a098bc6b6b108bf1759db 100644 (file)
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -293,18 +293,23 @@ static ssize_t lbs_setuserscan(struct file *file,
        struct lbs_ioctl_user_scan_cfg *scan_cfg;
        union iwreq_data wrqu;
        int dur;
-       unsigned long addr = get_zeroed_page(GFP_KERNEL);
-       char *buf = (char *)addr;
+       char *buf = (char *)get_zeroed_page(GFP_KERNEL);
 
-       scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL);
-       if (!scan_cfg)
+       if (!buf)
                return -ENOMEM;
-
+               
        buf_size = min(count, len - 1);
        if (copy_from_user(buf, userbuf, buf_size)) {
                res = -EFAULT;
-               goto out_unlock;
+               goto out_buf;
+       }
+
+       scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL);
+       if (!scan_cfg) {
+               res = -ENOMEM;
+               goto out_buf;
        }
+       res = count;
 
        scan_cfg->bsstype = LBS_SCAN_BSS_TYPE_ANY;
 
@@ -317,15 +322,19 @@ static ssize_t lbs_setuserscan(struct file *file,
 
        lbs_scan_networks(priv, scan_cfg, 1);
        wait_event_interruptible(priv->adapter->cmd_pending,
-                                !priv->adapter->nr_cmd_pending);
+                                priv->adapter->surpriseremoved || !priv->adapter->nr_cmd_pending);
+
+       if (priv->adapter->surpriseremoved)
+               goto out_scan_cfg;
 
        memset(&wrqu, 0x00, sizeof(union iwreq_data));
        wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
 
-out_unlock:
-       free_page(addr);
+ out_scan_cfg:
        kfree(scan_cfg);
-       return count;
+ out_buf:
+       free_page((unsigned long)buf);
+       return res;
 }