openwrt/package/kernel/broadcom-wl/patches/919-fix-compilation-warning-for-stack-limit.patch

--- a/driver/wl_iw.c
+++ b/driver/wl_iw.c
@@ -495,9 +495,9 @@ wl_iw_get_range(
 )
 {
 	struct iw_range *range = (struct iw_range *) extra;
-	int channels[MAXCHANNEL+1];
-	wl_uint32_list_t *list = (wl_uint32_list_t *) channels;
-	wl_rateset_t rateset;
+	int *channels;
+	wl_uint32_list_t *list;
+	wl_rateset_t *rateset;
 	int error, i;
 	uint sf, ch;
 
@@ -506,6 +506,17 @@ wl_iw_get_range(
 	if (!extra)
 		return -EINVAL;
 
+	channels = kcalloc(MAXCHANNEL+1, sizeof(*channels), GFP_KERNEL);
+	if (!channels)
+		return -ENOMEM;
+	list = (wl_uint32_list_t *) channels;
+
+	rateset = kzalloc(sizeof(*rateset), GFP_KERNEL);
+	if (!rateset) {
+		error = -ENOMEM;
+		goto free_channels;
+	}
+
 	dwrq->length = sizeof(struct iw_range);
 	memset(range, 0, sizeof(range));
 
@@ -514,8 +525,9 @@ wl_iw_get_range(
 
 	/* Set available channels/frequencies */
 	list->count = htod32(MAXCHANNEL);
-	if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, sizeof(channels))))
-		return error;
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels,
+				   (MAXCHANNEL+1) * sizeof(*channels))))
+		goto free_rateset;
 	for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
 		range->freq[i].i = dtoh32(list->element[i]);
 
@@ -549,19 +561,19 @@ wl_iw_get_range(
 #endif /* WIRELESS_EXT > 11 */
 
 	/* Set available bitrates */
-	if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
-		return error;
-	rateset.count = dtoh32(rateset.count);
-	range->num_bitrates = rateset.count;
-	for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
-		range->bitrate[i] = (rateset.rates[i] & 0x7f) * 500000; /* convert to bps */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, rateset, sizeof(*rateset))))
+		goto free_rateset;
+	rateset->count = dtoh32(rateset->count);
+	range->num_bitrates = rateset->count;
+	for (i = 0; i < rateset->count && i < IW_MAX_BITRATES; i++)
+		range->bitrate[i] = (rateset->rates[i] & 0x7f) * 500000; /* convert to bps */
 
 	/* Set an indication of the max TCP throughput
 	 * in bit/s that we can expect using this interface.
 	 * May be use for QoS stuff... Jean II
 	 */
 	if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i))))
-		return error;
+		goto free_rateset;
 	i = dtoh32(i);
 	if (i == WLC_PHY_TYPE_A)
 		range->throughput = 24000000;	/* 24 Mbits/s */
@@ -624,7 +636,12 @@ wl_iw_get_range(
 #endif
 #endif /* WIRELESS_EXT > 17 */
 
-	return 0;
+free_rateset:
+	kfree(rateset);
+free_channels:
+	kfree(channels);
+
+	return error;
 }
 
 static int
--- a/driver/bcmsrom.c
+++ b/driver/bcmsrom.c
@@ -437,20 +437,37 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
            uint byteoff, uint nbytes, uint16 *buf)
 {
 	uint i, nw, crc_range;
-	uint16 old[SROM_MAXW], new[SROM_MAXW];
+	uint16 *old, *new;
 	uint8 crc;
 	volatile uint32 val32;
+	int rc = 0;
 
 	ASSERT(bustype == BUSTYPE(bustype));
 
+	old = MALLOC(osh, SROM_MAXW);
+	ASSERT(old != NULL);
+	if (!old)
+		return -2;
+
+	new = MALLOC(osh, SROM_MAXW);
+	ASSERT(new != NULL);
+	if (!new) {
+		rc = -2;
+		goto free_old;
+	}
+
 	/* check input - 16-bit access only. use byteoff 0x55aa to indicate
 	 * srclear
 	 */
-	if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1)))
-		return 1;
+	if ((byteoff != 0x55aa) && ((byteoff & 1) || (nbytes & 1))) {
+		rc = 1;
+		goto free_new;
+	}
 
-	if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX))
-		return 1;
+	if ((byteoff != 0x55aa) && ((byteoff + nbytes) > SROM_MAX)) {
+		rc = 1;
+		goto free_new;
+	}
 
 	if (BUSTYPE(bustype) == PCMCIA_BUS) {
 		crc_range = SROM_MAX;
@@ -467,8 +484,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 
 	nw = crc_range / 2;
 	/* read first small number words from srom, then adjust the length, read all */
-	if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
-		return 1;
+	if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
+		rc = 1;
+		goto free_new;
+	}
 
 	BS_ERROR(("%s: old[SROM4_SIGN] 0x%x, old[SROM8_SIGN] 0x%x\n",
 	          __FUNCTION__, old[SROM4_SIGN], old[SROM8_SIGN]));
@@ -481,10 +500,13 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 				__FUNCTION__, buf[SROM4_SIGN], buf[SROM8_SIGN]));
 
 			/* block invalid buffer size */
-			if (nbytes < SROM4_WORDS * 2)
-				return BCME_BUFTOOSHORT;
-			else if (nbytes > SROM4_WORDS * 2)
-				return BCME_BUFTOOLONG;
+			if (nbytes < SROM4_WORDS * 2) {
+				rc = BCME_BUFTOOSHORT;
+				goto free_new;
+			} else if (nbytes > SROM4_WORDS * 2) {
+				rc = BCME_BUFTOOLONG;
+				goto free_new;
+			}
 
 			nw = SROM4_WORDS;
 		} else if (nbytes == SROM_WORDS * 2){ /* the other possible SROM format */
@@ -493,17 +515,22 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 			nw = SROM_WORDS;
 		} else {
 			BS_ERROR(("%s: Invalid input file signature\n", __FUNCTION__));
-			return BCME_BADARG;
+			rc = BCME_BADARG;
+			goto free_new;
 		}
 		crc_range = nw * 2;
-		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
-			return 1;
+		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
+			rc = 1;
+			goto free_new;
+		}
 	} else if ((old[SROM4_SIGN] == SROM4_SIGNATURE) ||
 	    (old[SROM8_SIGN] == SROM4_SIGNATURE)) {
 		nw = SROM4_WORDS;
 		crc_range = nw * 2;
-		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE))
-			return 1;
+		if (srom_read(sih, bustype, curmap, osh, 0, crc_range, old, FALSE)) {
+			rc = 1;
+			goto free_new;
+		}
 	} else {
 		/* Assert that we have already read enough for sromrev 2 */
 		ASSERT(crc_range >= SROM_WORDS * 2);
@@ -562,8 +589,10 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 		}
 	} else if (BUSTYPE(bustype) == PCMCIA_BUS) {
 		/* enable writes to the SPROM */
-		if (sprom_cmd_pcmcia(osh, SROM_WEN))
-			return 1;
+		if (sprom_cmd_pcmcia(osh, SROM_WEN)) {
+			rc = 1;
+			goto free_new;
+		}
 		bcm_mdelay(WRITE_ENABLE_DELAY);
 		/* write srom */
 		for (i = 0; i < nw; i++) {
@@ -573,14 +602,15 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 			}
 		}
 		/* disable writes to the SPROM */
-		if (sprom_cmd_pcmcia(osh, SROM_WDS))
-			return 1;
+		if (sprom_cmd_pcmcia(osh, SROM_WDS)) {
+			rc = 1;
+			goto free_new;
+		}
 	} else if (BUSTYPE(bustype) == SI_BUS) {
 #if defined(BCMUSBDEV)
 		if (SPROMBUS == PCMCIA_BUS) {
 			uint origidx;
 			void *regs;
-			int rc;
 			bool wasup;
 
 			origidx = si_coreidx(sih);
@@ -596,16 +626,24 @@ srom_write(si_t *sih, uint bustype, void *curmap, osl_t *osh,
 				si_core_disable(sih, 0);
 
 			si_setcoreidx(sih, origidx);
-			return rc;
+			goto free_new;
 		}
 #endif 
-		return 1;
+		rc = 1;
+		goto free_new;
 	} else {
-		return 1;
+		rc = 1;
+		goto free_new;
 	}
 
 	bcm_mdelay(WRITE_ENABLE_DELAY);
-	return 0;
+	rc = 0;
+
+free_new:
+	MFREE(osh, new, SROM_MAXW);
+free_old:
+	MFREE(osh, old, SROM_MAXW);
+	return rc;
 }
 
 #if defined(BCMUSBDEV)
--- a/driver/linux_osl.c
+++ b/driver/linux_osl.c
@@ -600,20 +600,29 @@ int
 osl_printf(const char *format, ...)
 {
 	va_list args;
-	char buf[1024];
+	char *buf;
 	int len;
 
+	buf = kcalloc(1024, sizeof(*buf), GFP_KERNEL);
+	if (!buf)
+		return (-ENOMEM);
+
 	/* sprintf into a local buffer because there *is* no "vprintk()".. */
 	va_start(args, format);
 	len = vsnprintf(buf, 1024, format, args);
 	va_end(args);
 
-	if (len > sizeof(buf)) {
+	if (len > (sizeof(*buf) * 1024)) {
 		printk("osl_printf: buffer overrun\n");
-		return (0);
+		goto exit;
 	}
 
-	return (printk(buf));
+	printk(buf);
+
+exit:
+	kfree(buf);
+
+	return (0);
 }
 
 int
--- a/driver/bcmutils.c
+++ b/driver/bcmutils.c
@@ -13,6 +13,7 @@
 
 #include <typedefs.h>
 #include <bcmdefs.h>
+#define __need___va_list
 #include <stdarg.h>
 #include <bcmutils.h>
 #ifdef BCMDRIVER