input: Bugfixes in atkbd and psmouse-base probing. (use unsigned char param[]

       in atkbd_event, like everywhere else, use param[0] instead of *param
       at the same place, properly set serio->private to NULL if probe fails
       in both atkbd and psmouse, and fix preinitializing of the return buffer
       in *_command() funcitons.)

drivers/input/keyboard/atkbd.c

@@ -334,6 +334,10 @@ static int atkbd_command(struct atkbd *atkbd, unsigned char *param, int command)
 	if (command == ATKBD_CMD_RESET_BAT)
 		timeout = 2000000; /* 2 sec */
 
+	if (receive && param)
+		for (i = 0; i < receive; i++)
+			atkbd->cmdbuf[(receive - 1) - i] = param[i];
+	
 	if (command & 0xff)
 		if (atkbd_sendbyte(atkbd, command & 0xff))
 			return (atkbd->cmdcnt = 0) - 1;
@@ -385,7 +389,7 @@ static int atkbd_event(struct input_dev *dev, unsigned int type, unsigned int co
 		 133, 149, 167, 182, 200, 217, 232, 250, 270, 303, 333, 370, 400, 435, 470, 500 };
 	const short delay[4] =
 		{ 250, 500, 750, 1000 };
-	char param[2];
+	unsigned char param[2];
 	int i, j;
 
 	if (!atkbd->write)
@@ -395,7 +399,7 @@ static int atkbd_event(struct input_dev *dev, unsigned int type, unsigned int co
 
 		case EV_LED:
 
-			*param = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
+			param[0] = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
 			         | (test_bit(LED_NUML,    dev->led) ? 2 : 0)
 			         | (test_bit(LED_CAPSL,   dev->led) ? 4 : 0);
 		        atkbd_command(atkbd, param, ATKBD_CMD_SETLEDS);
@@ -456,6 +460,7 @@ static int atkbd_probe(struct atkbd *atkbd)
  * should make sure we don't try to set the LEDs on it.
  */
 
+	param[0] = param[1] = 0xa5;	/* initialize with invalid values */
 	if (atkbd_command(atkbd, param, ATKBD_CMD_GETID)) {
 
 /*
@@ -662,6 +667,7 @@ static void atkbd_connect(struct serio *serio, struct serio_dev *dev)
 
 		if (atkbd_probe(atkbd)) {
 			serio_close(serio);
+			serio->private = NULL;
 			kfree(atkbd);
 			return;
 		}

drivers/input/mouse/psmouse-base.c

@@ -235,6 +235,11 @@ int psmouse_command(struct psmouse *psmouse, unsigned char *param, int command)
 	if (command == PSMOUSE_CMD_RESET_BAT)
                 timeout = 4000000; /* 4 sec */
 
+	/* initialize cmdbuf with preset values from param */
+	if (receive)
+	   for (i = 0; i < receive; i++)
+		psmouse->cmdbuf[(receive - 1) - i] = param[i];
+
 	if (command & 0xff)
 		if (psmouse_sendbyte(psmouse, command & 0xff))
 			return (psmouse->cmdcnt = 0) - 1;
@@ -245,8 +250,9 @@ int psmouse_command(struct psmouse *psmouse, unsigned char *param, int command)
 
 	while (psmouse->cmdcnt && timeout--) {
 	
-		if (psmouse->cmdcnt == 1 && command == PSMOUSE_CMD_RESET_BAT)
-			timeout = 100000;
+		if (psmouse->cmdcnt == 1 && command == PSMOUSE_CMD_RESET_BAT &&
+				timeout > 100000) /* do not run in a endless loop */
+			timeout = 100000; /* 1 sec */
 
 		if (psmouse->cmdcnt == 1 && command == PSMOUSE_CMD_GETID &&
 		    psmouse->cmdbuf[1] != 0xab && psmouse->cmdbuf[1] != 0xac) {
@@ -414,7 +420,7 @@ static int psmouse_probe(struct psmouse *psmouse)
  * in case of an IntelliMouse in 4-byte mode or 0x04 for IM Explorer.
  */
 
-	param[0] = param[1] = 0xa5;
+	param[0] = 0xa5;
 
 	if (psmouse_command(psmouse, param, PSMOUSE_CMD_GETID))
 		return -1;
@@ -578,12 +584,14 @@ static void psmouse_connect(struct serio *serio, struct serio_dev *dev)
 	serio->private = psmouse;
 	if (serio_open(serio, dev)) {
 		kfree(psmouse);
+		serio->private = NULL;
 		return;
 	}
 
 	if (psmouse_probe(psmouse) <= 0) {
 		serio_close(serio);
 		kfree(psmouse);
+		serio->private = NULL;
 		return;
 	}