Merge tag 'media/v4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

+68 -37

drivers/media/usb/b2c2/flexcop-usb.c

··· 73 73 u8 request_type = (read ? USB_DIR_IN : USB_DIR_OUT) | USB_TYPE_VENDOR; 74 74 u8 wAddress = B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(wRegOffsPCI) | 75 75 (read ? 0x80 : 0); 76 + int ret; 76 77 77 - int len = usb_control_msg(fc_usb->udev, 78 + mutex_lock(&fc_usb->data_mutex); 79 + if (!read) 80 + memcpy(fc_usb->data, val, sizeof(*val)); 81 + 82 + ret = usb_control_msg(fc_usb->udev, 78 83 read ? B2C2_USB_CTRL_PIPE_IN : B2C2_USB_CTRL_PIPE_OUT, 79 84 request, 80 85 request_type, /* 0xc0 read or 0x40 write */ 81 86 wAddress, 82 87 0, 83 - val, 88 + fc_usb->data, 84 89 sizeof(u32), 85 90 B2C2_WAIT_FOR_OPERATION_RDW * HZ); 86 91 87 - if (len != sizeof(u32)) { 92 + if (ret != sizeof(u32)) { 88 93 err("error while %s dword from %d (%d).", read ? "reading" : 89 94 "writing", wAddress, wRegOffsPCI); 90 - return -EIO; 95 + if (ret >= 0) 96 + ret = -EIO; 91 97 } 92 - return 0; 98 + 99 + if (read && ret >= 0) 100 + memcpy(val, fc_usb->data, sizeof(*val)); 101 + mutex_unlock(&fc_usb->data_mutex); 102 + 103 + return ret; 93 104 } 94 105 /* 95 106 * DKT 010817 - add support for V8 memory read/write and flash update ··· 111 100 { 112 101 u8 request_type = USB_TYPE_VENDOR; 113 102 u16 wIndex; 114 - int nWaitTime, pipe, len; 103 + int nWaitTime, pipe, ret; 115 104 wIndex = page << 8; 105 + 106 + if (buflen > sizeof(fc_usb->data)) { 107 + err("Buffer size bigger than max URB control message\n"); 108 + return -EIO; 109 + } 116 110 117 111 switch (req) { 118 112 case B2C2_USB_READ_V8_MEM: ··· 143 127 deb_v8("v8mem: %02x %02x %04x %04x, len: %d\n", request_type, req, 144 128 wAddress, wIndex, buflen); 145 129 146 - len = usb_control_msg(fc_usb->udev, pipe, 130 + mutex_lock(&fc_usb->data_mutex); 131 + 132 + if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT) 133 + memcpy(fc_usb->data, pbBuffer, buflen); 134 + 135 + ret = usb_control_msg(fc_usb->udev, pipe, 147 136 req, 148 137 request_type, 149 138 wAddress, 150 139 wIndex, 151 - pbBuffer, 140 + fc_usb->data, 152 141 buflen, 153 142 nWaitTime * HZ); 143 + if (ret != buflen) 144 + ret = -EIO; 154 145 155 - debug_dump(pbBuffer, len, deb_v8); 156 - return len == buflen ? 0 : -EIO; 146 + if (ret >= 0) { 147 + ret = 0; 148 + if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN) 149 + memcpy(pbBuffer, fc_usb->data, buflen); 150 + } 151 + 152 + mutex_unlock(&fc_usb->data_mutex); 153 + 154 + debug_dump(pbBuffer, ret, deb_v8); 155 + return ret; 157 156 } 158 157 159 158 #define bytes_left_to_read_on_page(paddr,buflen) \ ··· 227 196 fc->dvb_adapter.proposed_mac, 6); 228 197 } 229 198 230 - #if 0 231 - static int flexcop_usb_utility_req(struct flexcop_usb *fc_usb, int set, 232 - flexcop_usb_utility_function_t func, u8 extra, u16 wIndex, 233 - u16 buflen, u8 *pvBuffer) 234 - { 235 - u16 wValue; 236 - u8 request_type = (set ? USB_DIR_OUT : USB_DIR_IN) | USB_TYPE_VENDOR; 237 - int nWaitTime = 2, 238 - pipe = set ? B2C2_USB_CTRL_PIPE_OUT : B2C2_USB_CTRL_PIPE_IN, len; 239 - wValue = (func << 8) | extra; 240 - 241 - len = usb_control_msg(fc_usb->udev,pipe, 242 - B2C2_USB_UTILITY, 243 - request_type, 244 - wValue, 245 - wIndex, 246 - pvBuffer, 247 - buflen, 248 - nWaitTime * HZ); 249 - return len == buflen ? 0 : -EIO; 250 - } 251 - #endif 252 - 253 199 /* usb i2c stuff */ 254 200 static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, 255 201 flexcop_usb_request_t req, flexcop_usb_i2c_function_t func, ··· 234 226 { 235 227 struct flexcop_usb *fc_usb = i2c->fc->bus_specific; 236 228 u16 wValue, wIndex; 237 - int nWaitTime,pipe,len; 229 + int nWaitTime, pipe, ret; 238 230 u8 request_type = USB_TYPE_VENDOR; 231 + 232 + if (buflen > sizeof(fc_usb->data)) { 233 + err("Buffer size bigger than max URB control message\n"); 234 + return -EIO; 235 + } 239 236 240 237 switch (func) { 241 238 case USB_FUNC_I2C_WRITE: ··· 270 257 wValue & 0xff, wValue >> 8, 271 258 wIndex & 0xff, wIndex >> 8); 272 259 273 - len = usb_control_msg(fc_usb->udev,pipe, 260 + mutex_lock(&fc_usb->data_mutex); 261 + 262 + if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT) 263 + memcpy(fc_usb->data, buf, buflen); 264 + 265 + ret = usb_control_msg(fc_usb->udev, pipe, 274 266 req, 275 267 request_type, 276 268 wValue, 277 269 wIndex, 278 - buf, 270 + fc_usb->data, 279 271 buflen, 280 272 nWaitTime * HZ); 281 - return len == buflen ? 0 : -EREMOTEIO; 273 + 274 + if (ret != buflen) 275 + ret = -EIO; 276 + 277 + if (ret >= 0) { 278 + ret = 0; 279 + if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN) 280 + memcpy(buf, fc_usb->data, buflen); 281 + } 282 + 283 + mutex_unlock(&fc_usb->data_mutex); 284 + 285 + return 0; 282 286 } 283 287 284 288 /* actual bus specific access functions, ··· 546 516 /* general flexcop init */ 547 517 fc_usb = fc->bus_specific; 548 518 fc_usb->fc_dev = fc; 519 + mutex_init(&fc_usb->data_mutex); 549 520 550 521 fc->read_ibi_reg = flexcop_usb_read_ibi_reg; 551 522 fc->write_ibi_reg = flexcop_usb_write_ibi_reg;

+4

drivers/media/usb/b2c2/flexcop-usb.h

··· 29 29 30 30 u8 tmp_buffer[1023+190]; 31 31 int tmp_buffer_length; 32 + 33 + /* for URB control messages */ 34 + u8 data[80]; 35 + struct mutex data_mutex; 32 36 }; 33 37 34 38 #if 0

+30 -4

drivers/media/usb/cpia2/cpia2_usb.c

··· 545 545 static int write_packet(struct usb_device *udev, 546 546 u8 request, u8 * registers, u16 start, size_t size) 547 547 { 548 + unsigned char *buf; 549 + int ret; 550 + 548 551 if (!registers || size <= 0) 549 552 return -EINVAL; 550 553 551 - return usb_control_msg(udev, 554 + buf = kmalloc(size, GFP_KERNEL); 555 + if (!buf) 556 + return -ENOMEM; 557 + 558 + memcpy(buf, registers, size); 559 + 560 + ret = usb_control_msg(udev, 552 561 usb_sndctrlpipe(udev, 0), 553 562 request, 554 563 USB_TYPE_VENDOR | USB_RECIP_DEVICE, 555 564 start, /* value */ 556 565 0, /* index */ 557 - registers, /* buffer */ 566 + buf, /* buffer */ 558 567 size, 559 568 HZ); 569 + 570 + kfree(buf); 571 + return ret; 560 572 } 561 573 562 574 /**************************************************************************** ··· 579 567 static int read_packet(struct usb_device *udev, 580 568 u8 request, u8 * registers, u16 start, size_t size) 581 569 { 570 + unsigned char *buf; 571 + int ret; 572 + 582 573 if (!registers || size <= 0) 583 574 return -EINVAL; 584 575 585 - return usb_control_msg(udev, 576 + buf = kmalloc(size, GFP_KERNEL); 577 + if (!buf) 578 + return -ENOMEM; 579 + 580 + ret = usb_control_msg(udev, 586 581 usb_rcvctrlpipe(udev, 0), 587 582 request, 588 583 USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_DEVICE, 589 584 start, /* value */ 590 585 0, /* index */ 591 - registers, /* buffer */ 586 + buf, /* buffer */ 592 587 size, 593 588 HZ); 589 + 590 + if (ret >= 0) 591 + memcpy(registers, buf, size); 592 + 593 + kfree(buf); 594 + 595 + return ret; 594 596 } 595 597 596 598 /******************************************************************************

+180 -137

drivers/media/usb/dvb-usb/af9005.c

··· 52 52 struct af9005_device_state { 53 53 u8 sequence; 54 54 int led_state; 55 + unsigned char data[256]; 56 + struct mutex data_mutex; 55 57 }; 56 58 57 59 static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg, 58 60 int readwrite, int type, u8 * values, int len) 59 61 { 60 62 struct af9005_device_state *st = d->priv; 61 - u8 obuf[16] = { 0 }; 62 - u8 ibuf[17] = { 0 }; 63 - u8 command; 64 - int i; 65 - int ret; 63 + u8 command, seq; 64 + int i, ret; 66 65 67 66 if (len < 1) { 68 67 err("generic read/write, less than 1 byte. Makes no sense."); ··· 72 73 return -EINVAL; 73 74 } 74 75 75 - obuf[0] = 14; /* rest of buffer length low */ 76 - obuf[1] = 0; /* rest of buffer length high */ 76 + mutex_lock(&st->data_mutex); 77 + st->data[0] = 14; /* rest of buffer length low */ 78 + st->data[1] = 0; /* rest of buffer length high */ 77 79 78 - obuf[2] = AF9005_REGISTER_RW; /* register operation */ 79 - obuf[3] = 12; /* rest of buffer length */ 80 + st->data[2] = AF9005_REGISTER_RW; /* register operation */ 81 + st->data[3] = 12; /* rest of buffer length */ 80 82 81 - obuf[4] = st->sequence++; /* sequence number */ 83 + st->data[4] = seq = st->sequence++; /* sequence number */ 82 84 83 - obuf[5] = (u8) (reg >> 8); /* register address */ 84 - obuf[6] = (u8) (reg & 0xff); 85 + st->data[5] = (u8) (reg >> 8); /* register address */ 86 + st->data[6] = (u8) (reg & 0xff); 85 87 86 88 if (type == AF9005_OFDM_REG) { 87 89 command = AF9005_CMD_OFDM_REG; ··· 96 96 command |= readwrite; 97 97 if (readwrite == AF9005_CMD_WRITE) 98 98 for (i = 0; i < len; i++) 99 - obuf[8 + i] = values[i]; 99 + st->data[8 + i] = values[i]; 100 100 else if (type == AF9005_TUNER_REG) 101 101 /* read command for tuner, the first byte contains the i2c address */ 102 - obuf[8] = values[0]; 103 - obuf[7] = command; 102 + st->data[8] = values[0]; 103 + st->data[7] = command; 104 104 105 - ret = dvb_usb_generic_rw(d, obuf, 16, ibuf, 17, 0); 105 + ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 17, 0); 106 106 if (ret) 107 - return ret; 107 + goto ret; 108 108 109 109 /* sanity check */ 110 - if (ibuf[2] != AF9005_REGISTER_RW_ACK) { 110 + if (st->data[2] != AF9005_REGISTER_RW_ACK) { 111 111 err("generic read/write, wrong reply code."); 112 - return -EIO; 112 + ret = -EIO; 113 + goto ret; 113 114 } 114 - if (ibuf[3] != 0x0d) { 115 + if (st->data[3] != 0x0d) { 115 116 err("generic read/write, wrong length in reply."); 116 - return -EIO; 117 + ret = -EIO; 118 + goto ret; 117 119 } 118 - if (ibuf[4] != obuf[4]) { 120 + if (st->data[4] != seq) { 119 121 err("generic read/write, wrong sequence in reply."); 120 - return -EIO; 122 + ret = -EIO; 123 + goto ret; 121 124 } 122 125 /* 123 - Windows driver doesn't check these fields, in fact sometimes 124 - the register in the reply is different that what has been sent 125 - 126 - if (ibuf[5] != obuf[5] || ibuf[6] != obuf[6]) { 127 - err("generic read/write, wrong register in reply."); 128 - return -EIO; 129 - } 130 - if (ibuf[7] != command) { 131 - err("generic read/write wrong command in reply."); 132 - return -EIO; 133 - } 126 + * In thesis, both input and output buffers should have 127 + * identical values for st->data[5] to st->data[8]. 128 + * However, windows driver doesn't check these fields, in fact 129 + * sometimes the register in the reply is different that what 130 + * has been sent 134 131 */ 135 - if (ibuf[16] != 0x01) { 132 + if (st->data[16] != 0x01) { 136 133 err("generic read/write wrong status code in reply."); 137 - return -EIO; 134 + ret = -EIO; 135 + goto ret; 138 136 } 137 + 139 138 if (readwrite == AF9005_CMD_READ) 140 139 for (i = 0; i < len; i++) 141 - values[i] = ibuf[8 + i]; 140 + values[i] = st->data[8 + i]; 142 141 143 - return 0; 142 + ret: 143 + mutex_unlock(&st->data_mutex); 144 + return ret; 144 145 145 146 } 146 147 ··· 465 464 struct af9005_device_state *st = d->priv; 466 465 467 466 int ret, i, packet_len; 468 - u8 buf[64]; 469 - u8 ibuf[64]; 467 + u8 seq; 470 468 471 469 if (wlen < 0) { 472 470 err("send command, wlen less than 0 bytes. Makes no sense."); ··· 480 480 return -EINVAL; 481 481 } 482 482 packet_len = wlen + 5; 483 - buf[0] = (u8) (packet_len & 0xff); 484 - buf[1] = (u8) ((packet_len & 0xff00) >> 8); 485 483 486 - buf[2] = 0x26; /* packet type */ 487 - buf[3] = wlen + 3; 488 - buf[4] = st->sequence++; 489 - buf[5] = command; 490 - buf[6] = wlen; 484 + mutex_lock(&st->data_mutex); 485 + 486 + st->data[0] = (u8) (packet_len & 0xff); 487 + st->data[1] = (u8) ((packet_len & 0xff00) >> 8); 488 + 489 + st->data[2] = 0x26; /* packet type */ 490 + st->data[3] = wlen + 3; 491 + st->data[4] = seq = st->sequence++; 492 + st->data[5] = command; 493 + st->data[6] = wlen; 491 494 for (i = 0; i < wlen; i++) 492 - buf[7 + i] = wbuf[i]; 493 - ret = dvb_usb_generic_rw(d, buf, wlen + 7, ibuf, rlen + 7, 0); 494 - if (ret) 495 - return ret; 496 - if (ibuf[2] != 0x27) { 495 + st->data[7 + i] = wbuf[i]; 496 + ret = dvb_usb_generic_rw(d, st->data, wlen + 7, st->data, rlen + 7, 0); 497 + if (st->data[2] != 0x27) { 497 498 err("send command, wrong reply code."); 498 - return -EIO; 499 - } 500 - if (ibuf[4] != buf[4]) { 499 + ret = -EIO; 500 + } else if (st->data[4] != seq) { 501 501 err("send command, wrong sequence in reply."); 502 - return -EIO; 503 - } 504 - if (ibuf[5] != 0x01) { 502 + ret = -EIO; 503 + } else if (st->data[5] != 0x01) { 505 504 err("send command, wrong status code in reply."); 506 - return -EIO; 507 - } 508 - if (ibuf[6] != rlen) { 505 + ret = -EIO; 506 + } else if (st->data[6] != rlen) { 509 507 err("send command, invalid data length in reply."); 510 - return -EIO; 508 + ret = -EIO; 511 509 } 512 - for (i = 0; i < rlen; i++) 513 - rbuf[i] = ibuf[i + 7]; 514 - return 0; 510 + if (!ret) { 511 + for (i = 0; i < rlen; i++) 512 + rbuf[i] = st->data[i + 7]; 513 + } 514 + 515 + mutex_unlock(&st->data_mutex); 516 + return ret; 515 517 } 516 518 517 519 int af9005_read_eeprom(struct dvb_usb_device *d, u8 address, u8 * values, 518 520 int len) 519 521 { 520 522 struct af9005_device_state *st = d->priv; 521 - u8 obuf[16], ibuf[14]; 523 + u8 seq; 522 524 int ret, i; 523 525 524 - memset(obuf, 0, sizeof(obuf)); 525 - memset(ibuf, 0, sizeof(ibuf)); 526 + mutex_lock(&st->data_mutex); 526 527 527 - obuf[0] = 14; /* length of rest of packet low */ 528 - obuf[1] = 0; /* length of rest of packer high */ 528 + memset(st->data, 0, sizeof(st->data)); 529 529 530 - obuf[2] = 0x2a; /* read/write eeprom */ 530 + st->data[0] = 14; /* length of rest of packet low */ 531 + st->data[1] = 0; /* length of rest of packer high */ 531 532 532 - obuf[3] = 12; /* size */ 533 + st->data[2] = 0x2a; /* read/write eeprom */ 533 534 534 - obuf[4] = st->sequence++; 535 + st->data[3] = 12; /* size */ 535 536 536 - obuf[5] = 0; /* read */ 537 + st->data[4] = seq = st->sequence++; 537 538 538 - obuf[6] = len; 539 - obuf[7] = address; 540 - ret = dvb_usb_generic_rw(d, obuf, 16, ibuf, 14, 0); 541 - if (ret) 542 - return ret; 543 - if (ibuf[2] != 0x2b) { 539 + st->data[5] = 0; /* read */ 540 + 541 + st->data[6] = len; 542 + st->data[7] = address; 543 + ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 14, 0); 544 + if (st->data[2] != 0x2b) { 544 545 err("Read eeprom, invalid reply code"); 545 - return -EIO; 546 - } 547 - if (ibuf[3] != 10) { 546 + ret = -EIO; 547 + } else if (st->data[3] != 10) { 548 548 err("Read eeprom, invalid reply length"); 549 - return -EIO; 550 - } 551 - if (ibuf[4] != obuf[4]) { 549 + ret = -EIO; 550 + } else if (st->data[4] != seq) { 552 551 err("Read eeprom, wrong sequence in reply "); 553 - return -EIO; 554 - } 555 - if (ibuf[5] != 1) { 552 + ret = -EIO; 553 + } else if (st->data[5] != 1) { 556 554 err("Read eeprom, wrong status in reply "); 557 - return -EIO; 555 + ret = -EIO; 558 556 } 559 - for (i = 0; i < len; i++) { 560 - values[i] = ibuf[6 + i]; 557 + 558 + if (!ret) { 559 + for (i = 0; i < len; i++) 560 + values[i] = st->data[6 + i]; 561 561 } 562 - return 0; 562 + mutex_unlock(&st->data_mutex); 563 + 564 + return ret; 563 565 } 564 566 565 - static int af9005_boot_packet(struct usb_device *udev, int type, u8 * reply) 567 + static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply, 568 + u8 *buf, int size) 566 569 { 567 - u8 buf[FW_BULKOUT_SIZE + 2]; 568 570 u16 checksum; 569 571 int act_len, i, ret; 570 - memset(buf, 0, sizeof(buf)); 572 + 573 + memset(buf, 0, size); 571 574 buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff); 572 575 buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff); 573 576 switch (type) { ··· 723 720 { 724 721 int i, packets, ret, act_len; 725 722 726 - u8 buf[FW_BULKOUT_SIZE + 2]; 723 + u8 *buf; 727 724 u8 reply; 728 725 729 - ret = af9005_boot_packet(udev, FW_CONFIG, &reply); 726 + buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL); 727 + if (!buf) 728 + return -ENOMEM; 729 + 730 + ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf, 731 + FW_BULKOUT_SIZE + 2); 730 732 if (ret) 731 - return ret; 733 + goto err; 732 734 if (reply != 0x01) { 733 735 err("before downloading firmware, FW_CONFIG expected 0x01, received 0x%x", reply); 734 - return -EIO; 736 + ret = -EIO; 737 + goto err; 735 738 } 736 739 packets = fw->size / FW_BULKOUT_SIZE; 737 740 buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff); ··· 752 743 buf, FW_BULKOUT_SIZE + 2, &act_len, 1000); 753 744 if (ret) { 754 745 err("firmware download failed at packet %d with code %d", i, ret); 755 - return ret; 746 + goto err; 756 747 } 757 748 } 758 - ret = af9005_boot_packet(udev, FW_CONFIRM, &reply); 749 + ret = af9005_boot_packet(udev, FW_CONFIRM, &reply, 750 + buf, FW_BULKOUT_SIZE + 2); 759 751 if (ret) 760 - return ret; 752 + goto err; 761 753 if (reply != (u8) (packets & 0xff)) { 762 754 err("after downloading firmware, FW_CONFIRM expected 0x%x, received 0x%x", packets & 0xff, reply); 763 - return -EIO; 755 + ret = -EIO; 756 + goto err; 764 757 } 765 - ret = af9005_boot_packet(udev, FW_BOOT, &reply); 758 + ret = af9005_boot_packet(udev, FW_BOOT, &reply, buf, 759 + FW_BULKOUT_SIZE + 2); 766 760 if (ret) 767 - return ret; 768 - ret = af9005_boot_packet(udev, FW_CONFIG, &reply); 761 + goto err; 762 + ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf, 763 + FW_BULKOUT_SIZE + 2); 769 764 if (ret) 770 - return ret; 765 + goto err; 771 766 if (reply != 0x02) { 772 767 err("after downloading firmware, FW_CONFIG expected 0x02, received 0x%x", reply); 773 - return -EIO; 768 + ret = -EIO; 769 + goto err; 774 770 } 775 771 776 - return 0; 772 + err: 773 + kfree(buf); 774 + return ret; 777 775 778 776 } 779 777 ··· 839 823 { 840 824 struct af9005_device_state *st = d->priv; 841 825 int ret, len; 842 - 843 - u8 obuf[5]; 844 - u8 ibuf[256]; 826 + u8 seq; 845 827 846 828 *state = REMOTE_NO_KEY_PRESSED; 847 829 if (rc_decode == NULL) { 848 830 /* it shouldn't never come here */ 849 831 return 0; 850 832 } 833 + 834 + mutex_lock(&st->data_mutex); 835 + 851 836 /* deb_info("rc_query\n"); */ 852 - obuf[0] = 3; /* rest of packet length low */ 853 - obuf[1] = 0; /* rest of packet lentgh high */ 854 - obuf[2] = 0x40; /* read remote */ 855 - obuf[3] = 1; /* rest of packet length */ 856 - obuf[4] = st->sequence++; /* sequence number */ 857 - ret = dvb_usb_generic_rw(d, obuf, 5, ibuf, 256, 0); 837 + st->data[0] = 3; /* rest of packet length low */ 838 + st->data[1] = 0; /* rest of packet lentgh high */ 839 + st->data[2] = 0x40; /* read remote */ 840 + st->data[3] = 1; /* rest of packet length */ 841 + st->data[4] = seq = st->sequence++; /* sequence number */ 842 + ret = dvb_usb_generic_rw(d, st->data, 5, st->data, 256, 0); 858 843 if (ret) { 859 844 err("rc query failed"); 860 - return ret; 845 + goto ret; 861 846 } 862 - if (ibuf[2] != 0x41) { 847 + if (st->data[2] != 0x41) { 863 848 err("rc query bad header."); 864 - return -EIO; 865 - } 866 - if (ibuf[4] != obuf[4]) { 849 + ret = -EIO; 850 + goto ret; 851 + } else if (st->data[4] != seq) { 867 852 err("rc query bad sequence."); 868 - return -EIO; 853 + ret = -EIO; 854 + goto ret; 869 855 } 870 - len = ibuf[5]; 856 + len = st->data[5]; 871 857 if (len > 246) { 872 858 err("rc query invalid length"); 873 - return -EIO; 859 + ret = -EIO; 860 + goto ret; 874 861 } 875 862 if (len > 0) { 876 863 deb_rc("rc data (%d) ", len); 877 - debug_dump((ibuf + 6), len, deb_rc); 878 - ret = rc_decode(d, &ibuf[6], len, event, state); 864 + debug_dump((st->data + 6), len, deb_rc); 865 + ret = rc_decode(d, &st->data[6], len, event, state); 879 866 if (ret) { 880 867 err("rc_decode failed"); 881 - return ret; 868 + goto ret; 882 869 } else { 883 870 deb_rc("rc_decode state %x event %x\n", *state, *event); 884 871 if (*state == REMOTE_KEY_REPEAT) 885 872 *event = d->last_event; 886 873 } 887 874 } 888 - return 0; 875 + 876 + ret: 877 + mutex_unlock(&st->data_mutex); 878 + return ret; 889 879 } 890 880 891 881 static int af9005_power_ctrl(struct dvb_usb_device *d, int onoff) ··· 975 953 int *cold) 976 954 { 977 955 int ret; 978 - u8 reply; 979 - ret = af9005_boot_packet(udev, FW_CONFIG, &reply); 956 + u8 reply, *buf; 957 + 958 + buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL); 959 + if (!buf) 960 + return -ENOMEM; 961 + 962 + ret = af9005_boot_packet(udev, FW_CONFIG, &reply, 963 + buf, FW_BULKOUT_SIZE + 2); 980 964 if (ret) 981 - return ret; 965 + goto err; 982 966 deb_info("result of FW_CONFIG in identify state %d\n", reply); 983 967 if (reply == 0x01) 984 968 *cold = 1; ··· 993 965 else 994 966 return -EIO; 995 967 deb_info("Identify state cold = %d\n", *cold); 996 - return 0; 968 + 969 + err: 970 + kfree(buf); 971 + return ret; 997 972 } 998 973 999 974 static struct dvb_usb_device_properties af9005_properties; ··· 1004 973 static int af9005_usb_probe(struct usb_interface *intf, 1005 974 const struct usb_device_id *id) 1006 975 { 1007 - return dvb_usb_device_init(intf, &af9005_properties, 1008 - THIS_MODULE, NULL, adapter_nr); 976 + struct dvb_usb_device *d; 977 + struct af9005_device_state *st; 978 + int ret; 979 + 980 + ret = dvb_usb_device_init(intf, &af9005_properties, 981 + THIS_MODULE, &d, adapter_nr); 982 + 983 + if (ret < 0) 984 + return ret; 985 + 986 + st = d->priv; 987 + mutex_init(&st->data_mutex); 988 + 989 + return 0; 1009 990 } 1010 991 1011 992 enum af9005_usb_table_entry {

+65 -25

drivers/media/usb/dvb-usb/cinergyT2-core.c

··· 41 41 42 42 struct cinergyt2_state { 43 43 u8 rc_counter; 44 + unsigned char data[64]; 45 + struct mutex data_mutex; 44 46 }; 45 47 46 48 /* We are missing a release hook with usb_device data */ ··· 52 50 53 51 static int cinergyt2_streaming_ctrl(struct dvb_usb_adapter *adap, int enable) 54 52 { 55 - char buf[] = { CINERGYT2_EP1_CONTROL_STREAM_TRANSFER, enable ? 1 : 0 }; 56 - char result[64]; 57 - return dvb_usb_generic_rw(adap->dev, buf, sizeof(buf), result, 58 - sizeof(result), 0); 53 + struct dvb_usb_device *d = adap->dev; 54 + struct cinergyt2_state *st = d->priv; 55 + int ret; 56 + 57 + mutex_lock(&st->data_mutex); 58 + st->data[0] = CINERGYT2_EP1_CONTROL_STREAM_TRANSFER; 59 + st->data[1] = enable ? 1 : 0; 60 + 61 + ret = dvb_usb_generic_rw(d, st->data, 2, st->data, 64, 0); 62 + mutex_unlock(&st->data_mutex); 63 + 64 + return ret; 59 65 } 60 66 61 67 static int cinergyt2_power_ctrl(struct dvb_usb_device *d, int enable) 62 68 { 63 - char buf[] = { CINERGYT2_EP1_SLEEP_MODE, enable ? 0 : 1 }; 64 - char state[3]; 65 - return dvb_usb_generic_rw(d, buf, sizeof(buf), state, sizeof(state), 0); 69 + struct cinergyt2_state *st = d->priv; 70 + int ret; 71 + 72 + mutex_lock(&st->data_mutex); 73 + st->data[0] = CINERGYT2_EP1_SLEEP_MODE; 74 + st->data[1] = enable ? 0 : 1; 75 + 76 + ret = dvb_usb_generic_rw(d, st->data, 2, st->data, 3, 0); 77 + mutex_unlock(&st->data_mutex); 78 + 79 + return ret; 66 80 } 67 81 68 82 static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap) 69 83 { 70 - char query[] = { CINERGYT2_EP1_GET_FIRMWARE_VERSION }; 71 - char state[3]; 84 + struct dvb_usb_device *d = adap->dev; 85 + struct cinergyt2_state *st = d->priv; 72 86 int ret; 73 87 74 88 adap->fe_adap[0].fe = cinergyt2_fe_attach(adap->dev); 75 89 76 - ret = dvb_usb_generic_rw(adap->dev, query, sizeof(query), state, 77 - sizeof(state), 0); 90 + mutex_lock(&st->data_mutex); 91 + st->data[0] = CINERGYT2_EP1_GET_FIRMWARE_VERSION; 92 + 93 + ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0); 78 94 if (ret < 0) { 79 95 deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep " 80 96 "state info\n"); 81 97 } 98 + mutex_unlock(&st->data_mutex); 82 99 83 100 /* Copy this pointer as we are gonna need it in the release phase */ 84 101 cinergyt2_usb_device = adap->dev; 85 102 86 - return 0; 103 + return ret; 87 104 } 88 105 89 106 static struct rc_map_table rc_map_cinergyt2_table[] = { ··· 162 141 static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state) 163 142 { 164 143 struct cinergyt2_state *st = d->priv; 165 - u8 key[5] = {0, 0, 0, 0, 0}, cmd = CINERGYT2_EP1_GET_RC_EVENTS; 166 - int i; 144 + int i, ret; 167 145 168 146 *state = REMOTE_NO_KEY_PRESSED; 169 147 170 - dvb_usb_generic_rw(d, &cmd, 1, key, sizeof(key), 0); 171 - if (key[4] == 0xff) { 148 + mutex_lock(&st->data_mutex); 149 + st->data[0] = CINERGYT2_EP1_GET_RC_EVENTS; 150 + 151 + ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 5, 0); 152 + if (ret < 0) 153 + goto ret; 154 + 155 + if (st->data[4] == 0xff) { 172 156 /* key repeat */ 173 157 st->rc_counter++; 174 158 if (st->rc_counter > RC_REPEAT_DELAY) { ··· 183 157 *event = d->last_event; 184 158 deb_rc("repeat key, event %x\n", 185 159 *event); 186 - return 0; 160 + goto ret; 187 161 } 188 162 } 189 163 deb_rc("repeated key (non repeatable)\n"); 190 164 } 191 - return 0; 165 + goto ret; 192 166 } 193 167 194 168 /* hack to pass checksum on the custom field */ 195 - key[2] = ~key[1]; 196 - dvb_usb_nec_rc_key_to_event(d, key, event, state); 197 - if (key[0] != 0) { 169 + st->data[2] = ~st->data[1]; 170 + dvb_usb_nec_rc_key_to_event(d, st->data, event, state); 171 + if (st->data[0] != 0) { 198 172 if (*event != d->last_event) 199 173 st->rc_counter = 0; 200 174 201 - deb_rc("key: %*ph\n", 5, key); 175 + deb_rc("key: %*ph\n", 5, st->data); 202 176 } 203 - return 0; 177 + 178 + ret: 179 + mutex_unlock(&st->data_mutex); 180 + return ret; 204 181 } 205 182 206 183 static int cinergyt2_usb_probe(struct usb_interface *intf, 207 184 const struct usb_device_id *id) 208 185 { 209 - return dvb_usb_device_init(intf, &cinergyt2_properties, 210 - THIS_MODULE, NULL, adapter_nr); 186 + struct dvb_usb_device *d; 187 + struct cinergyt2_state *st; 188 + int ret; 189 + 190 + ret = dvb_usb_device_init(intf, &cinergyt2_properties, 191 + THIS_MODULE, &d, adapter_nr); 192 + if (ret < 0) 193 + return ret; 194 + 195 + st = d->priv; 196 + mutex_init(&st->data_mutex); 197 + 198 + return 0; 211 199 } 212 200 213 201

+38 -62

drivers/media/usb/dvb-usb/cinergyT2-fe.c

··· 139 139 struct cinergyt2_fe_state { 140 140 struct dvb_frontend fe; 141 141 struct dvb_usb_device *d; 142 + 143 + unsigned char data[64]; 144 + struct mutex data_mutex; 145 + 146 + struct dvbt_get_status_msg status; 142 147 }; 143 148 144 149 static int cinergyt2_fe_read_status(struct dvb_frontend *fe, 145 150 enum fe_status *status) 146 151 { 147 152 struct cinergyt2_fe_state *state = fe->demodulator_priv; 148 - struct dvbt_get_status_msg result; 149 - u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; 150 153 int ret; 151 154 152 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&result, 153 - sizeof(result), 0); 155 + mutex_lock(&state->data_mutex); 156 + state->data[0] = CINERGYT2_EP1_GET_TUNER_STATUS; 157 + 158 + ret = dvb_usb_generic_rw(state->d, state->data, 1, 159 + state->data, sizeof(state->status), 0); 160 + if (!ret) 161 + memcpy(&state->status, state->data, sizeof(state->status)); 162 + mutex_unlock(&state->data_mutex); 163 + 154 164 if (ret < 0) 155 165 return ret; 156 166 157 167 *status = 0; 158 168 159 - if (0xffff - le16_to_cpu(result.gain) > 30) 169 + if (0xffff - le16_to_cpu(state->status.gain) > 30) 160 170 *status |= FE_HAS_SIGNAL; 161 - if (result.lock_bits & (1 << 6)) 171 + if (state->status.lock_bits & (1 << 6)) 162 172 *status |= FE_HAS_LOCK; 163 - if (result.lock_bits & (1 << 5)) 173 + if (state->status.lock_bits & (1 << 5)) 164 174 *status |= FE_HAS_SYNC; 165 - if (result.lock_bits & (1 << 4)) 175 + if (state->status.lock_bits & (1 << 4)) 166 176 *status |= FE_HAS_CARRIER; 167 - if (result.lock_bits & (1 << 1)) 177 + if (state->status.lock_bits & (1 << 1)) 168 178 *status |= FE_HAS_VITERBI; 169 179 170 180 if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) != ··· 187 177 static int cinergyt2_fe_read_ber(struct dvb_frontend *fe, u32 *ber) 188 178 { 189 179 struct cinergyt2_fe_state *state = fe->demodulator_priv; 190 - struct dvbt_get_status_msg status; 191 - char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; 192 - int ret; 193 180 194 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status, 195 - sizeof(status), 0); 196 - if (ret < 0) 197 - return ret; 198 - 199 - *ber = le32_to_cpu(status.viterbi_error_rate); 181 + *ber = le32_to_cpu(state->status.viterbi_error_rate); 200 182 return 0; 201 183 } 202 184 203 185 static int cinergyt2_fe_read_unc_blocks(struct dvb_frontend *fe, u32 *unc) 204 186 { 205 187 struct cinergyt2_fe_state *state = fe->demodulator_priv; 206 - struct dvbt_get_status_msg status; 207 - u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; 208 - int ret; 209 188 210 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&status, 211 - sizeof(status), 0); 212 - if (ret < 0) { 213 - err("cinergyt2_fe_read_unc_blocks() Failed! (Error=%d)\n", 214 - ret); 215 - return ret; 216 - } 217 - *unc = le32_to_cpu(status.uncorrected_block_count); 189 + *unc = le32_to_cpu(state->status.uncorrected_block_count); 218 190 return 0; 219 191 } 220 192 ··· 204 212 u16 *strength) 205 213 { 206 214 struct cinergyt2_fe_state *state = fe->demodulator_priv; 207 - struct dvbt_get_status_msg status; 208 - char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; 209 - int ret; 210 215 211 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status, 212 - sizeof(status), 0); 213 - if (ret < 0) { 214 - err("cinergyt2_fe_read_signal_strength() Failed!" 215 - " (Error=%d)\n", ret); 216 - return ret; 217 - } 218 - *strength = (0xffff - le16_to_cpu(status.gain)); 216 + *strength = (0xffff - le16_to_cpu(state->status.gain)); 219 217 return 0; 220 218 } 221 219 222 220 static int cinergyt2_fe_read_snr(struct dvb_frontend *fe, u16 *snr) 223 221 { 224 222 struct cinergyt2_fe_state *state = fe->demodulator_priv; 225 - struct dvbt_get_status_msg status; 226 - char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; 227 - int ret; 228 223 229 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status, 230 - sizeof(status), 0); 231 - if (ret < 0) { 232 - err("cinergyt2_fe_read_snr() Failed! (Error=%d)\n", ret); 233 - return ret; 234 - } 235 - *snr = (status.snr << 8) | status.snr; 224 + *snr = (state->status.snr << 8) | state->status.snr; 236 225 return 0; 237 226 } 238 227 ··· 239 266 { 240 267 struct dtv_frontend_properties *fep = &fe->dtv_property_cache; 241 268 struct cinergyt2_fe_state *state = fe->demodulator_priv; 242 - struct dvbt_set_parameters_msg param; 243 - char result[2]; 269 + struct dvbt_set_parameters_msg *param; 244 270 int err; 245 271 246 - param.cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS; 247 - param.tps = cpu_to_le16(compute_tps(fep)); 248 - param.freq = cpu_to_le32(fep->frequency / 1000); 249 - param.flags = 0; 272 + mutex_lock(&state->data_mutex); 273 + 274 + param = (void *)state->data; 275 + param->cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS; 276 + param->tps = cpu_to_le16(compute_tps(fep)); 277 + param->freq = cpu_to_le32(fep->frequency / 1000); 278 + param->flags = 0; 250 279 251 280 switch (fep->bandwidth_hz) { 252 281 default: 253 282 case 8000000: 254 - param.bandwidth = 8; 283 + param->bandwidth = 8; 255 284 break; 256 285 case 7000000: 257 - param.bandwidth = 7; 286 + param->bandwidth = 7; 258 287 break; 259 288 case 6000000: 260 - param.bandwidth = 6; 289 + param->bandwidth = 6; 261 290 break; 262 291 } 263 292 264 - err = dvb_usb_generic_rw(state->d, 265 - (char *)&param, sizeof(param), 266 - result, sizeof(result), 0); 293 + err = dvb_usb_generic_rw(state->d, state->data, sizeof(*param), 294 + state->data, 2, 0); 267 295 if (err < 0) 268 296 err("cinergyt2_fe_set_frontend() Failed! err=%d\n", err); 269 297 298 + mutex_unlock(&state->data_mutex); 270 299 return (err < 0) ? err : 0; 271 300 } 272 301 ··· 290 315 s->d = d; 291 316 memcpy(&s->fe.ops, &cinergyt2_fe_ops, sizeof(struct dvb_frontend_ops)); 292 317 s->fe.demodulator_priv = s; 318 + mutex_init(&s->data_mutex); 293 319 return &s->fe; 294 320 } 295 321

+35 -27

drivers/media/usb/dvb-usb/cxusb.c

··· 45 45 #include "si2168.h" 46 46 #include "si2157.h" 47 47 48 - /* Max transfer size done by I2C transfer functions */ 49 - #define MAX_XFER_SIZE 80 50 - 51 48 /* debug */ 52 49 static int dvb_usb_cxusb_debug; 53 50 module_param_named(debug, dvb_usb_cxusb_debug, int, 0644); ··· 58 61 static int cxusb_ctrl_msg(struct dvb_usb_device *d, 59 62 u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen) 60 63 { 61 - int wo = (rbuf == NULL || rlen == 0); /* write-only */ 62 - u8 sndbuf[MAX_XFER_SIZE]; 64 + struct cxusb_state *st = d->priv; 65 + int ret, wo; 63 66 64 - if (1 + wlen > sizeof(sndbuf)) { 65 - warn("i2c wr: len=%d is too big!\n", 66 - wlen); 67 + if (1 + wlen > MAX_XFER_SIZE) { 68 + warn("i2c wr: len=%d is too big!\n", wlen); 67 69 return -EOPNOTSUPP; 68 70 } 69 71 70 - memset(sndbuf, 0, 1+wlen); 72 + wo = (rbuf == NULL || rlen == 0); /* write-only */ 71 73 72 - sndbuf[0] = cmd; 73 - memcpy(&sndbuf[1], wbuf, wlen); 74 + mutex_lock(&st->data_mutex); 75 + st->data[0] = cmd; 76 + memcpy(&st->data[1], wbuf, wlen); 74 77 if (wo) 75 - return dvb_usb_generic_write(d, sndbuf, 1+wlen); 78 + ret = dvb_usb_generic_write(d, st->data, 1 + wlen); 76 79 else 77 - return dvb_usb_generic_rw(d, sndbuf, 1+wlen, rbuf, rlen, 0); 80 + ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, 81 + rbuf, rlen, 0); 82 + 83 + mutex_unlock(&st->data_mutex); 84 + return ret; 78 85 } 79 86 80 87 /* GPIO */ ··· 1461 1460 static int cxusb_probe(struct usb_interface *intf, 1462 1461 const struct usb_device_id *id) 1463 1462 { 1463 + struct dvb_usb_device *d; 1464 + struct cxusb_state *st; 1465 + 1464 1466 if (0 == dvb_usb_device_init(intf, &cxusb_medion_properties, 1465 - THIS_MODULE, NULL, adapter_nr) || 1467 + THIS_MODULE, &d, adapter_nr) || 1466 1468 0 == dvb_usb_device_init(intf, &cxusb_bluebird_lgh064f_properties, 1467 - THIS_MODULE, NULL, adapter_nr) || 1469 + THIS_MODULE, &d, adapter_nr) || 1468 1470 0 == dvb_usb_device_init(intf, &cxusb_bluebird_dee1601_properties, 1469 - THIS_MODULE, NULL, adapter_nr) || 1471 + THIS_MODULE, &d, adapter_nr) || 1470 1472 0 == dvb_usb_device_init(intf, &cxusb_bluebird_lgz201_properties, 1471 - THIS_MODULE, NULL, adapter_nr) || 1473 + THIS_MODULE, &d, adapter_nr) || 1472 1474 0 == dvb_usb_device_init(intf, &cxusb_bluebird_dtt7579_properties, 1473 - THIS_MODULE, NULL, adapter_nr) || 1475 + THIS_MODULE, &d, adapter_nr) || 1474 1476 0 == dvb_usb_device_init(intf, &cxusb_bluebird_dualdig4_properties, 1475 - THIS_MODULE, NULL, adapter_nr) || 1477 + THIS_MODULE, &d, adapter_nr) || 1476 1478 0 == dvb_usb_device_init(intf, &cxusb_bluebird_nano2_properties, 1477 - THIS_MODULE, NULL, adapter_nr) || 1479 + THIS_MODULE, &d, adapter_nr) || 1478 1480 0 == dvb_usb_device_init(intf, 1479 1481 &cxusb_bluebird_nano2_needsfirmware_properties, 1480 - THIS_MODULE, NULL, adapter_nr) || 1482 + THIS_MODULE, &d, adapter_nr) || 1481 1483 0 == dvb_usb_device_init(intf, &cxusb_aver_a868r_properties, 1482 - THIS_MODULE, NULL, adapter_nr) || 1484 + THIS_MODULE, &d, adapter_nr) || 1483 1485 0 == dvb_usb_device_init(intf, 1484 1486 &cxusb_bluebird_dualdig4_rev2_properties, 1485 - THIS_MODULE, NULL, adapter_nr) || 1487 + THIS_MODULE, &d, adapter_nr) || 1486 1488 0 == dvb_usb_device_init(intf, &cxusb_d680_dmb_properties, 1487 - THIS_MODULE, NULL, adapter_nr) || 1489 + THIS_MODULE, &d, adapter_nr) || 1488 1490 0 == dvb_usb_device_init(intf, &cxusb_mygica_d689_properties, 1489 - THIS_MODULE, NULL, adapter_nr) || 1491 + THIS_MODULE, &d, adapter_nr) || 1490 1492 0 == dvb_usb_device_init(intf, &cxusb_mygica_t230_properties, 1491 - THIS_MODULE, NULL, adapter_nr) || 1492 - 0) 1493 + THIS_MODULE, &d, adapter_nr) || 1494 + 0) { 1495 + st = d->priv; 1496 + mutex_init(&st->data_mutex); 1497 + 1493 1498 return 0; 1499 + } 1494 1500 1495 1501 return -EINVAL; 1496 1502 }

+6

drivers/media/usb/dvb-usb/cxusb.h

··· 28 28 #define CMD_ANALOG 0x50 29 29 #define CMD_DIGITAL 0x51 30 30 31 + /* Max transfer size done by I2C transfer functions */ 32 + #define MAX_XFER_SIZE 80 33 + 31 34 struct cxusb_state { 32 35 u8 gpio_write_state[3]; 33 36 struct i2c_client *i2c_client_demod; 34 37 struct i2c_client *i2c_client_tuner; 38 + 39 + unsigned char data[MAX_XFER_SIZE]; 40 + struct mutex data_mutex; 35 41 }; 36 42 37 43 #endif

+29 -2

drivers/media/usb/dvb-usb/dib0700_core.c

··· 213 213 usb_rcvctrlpipe(d->udev, 0), 214 214 REQUEST_NEW_I2C_READ, 215 215 USB_TYPE_VENDOR | USB_DIR_IN, 216 - value, index, msg[i].buf, 216 + value, index, st->buf, 217 217 msg[i].len, 218 218 USB_CTRL_GET_TIMEOUT); 219 219 if (result < 0) { 220 220 deb_info("i2c read error (status = %d)\n", result); 221 221 break; 222 222 } 223 + 224 + if (msg[i].len > sizeof(st->buf)) { 225 + deb_info("buffer too small to fit %d bytes\n", 226 + msg[i].len); 227 + return -EIO; 228 + } 229 + 230 + memcpy(msg[i].buf, st->buf, msg[i].len); 223 231 224 232 deb_data("<<< "); 225 233 debug_dump(msg[i].buf, msg[i].len, deb_data); ··· 246 238 /* I2C ctrl + FE bus; */ 247 239 st->buf[3] = ((gen_mode << 6) & 0xC0) | 248 240 ((bus_mode << 4) & 0x30); 241 + 242 + if (msg[i].len > sizeof(st->buf) - 4) { 243 + deb_info("i2c message to big: %d\n", 244 + msg[i].len); 245 + return -EIO; 246 + } 247 + 249 248 /* The Actual i2c payload */ 250 249 memcpy(&st->buf[4], msg[i].buf, msg[i].len); 251 250 ··· 298 283 /* fill in the address */ 299 284 st->buf[1] = msg[i].addr << 1; 300 285 /* fill the buffer */ 286 + if (msg[i].len > sizeof(st->buf) - 2) { 287 + deb_info("i2c xfer to big: %d\n", 288 + msg[i].len); 289 + return -EIO; 290 + } 301 291 memcpy(&st->buf[2], msg[i].buf, msg[i].len); 302 292 303 293 /* write/read request */ ··· 312 292 313 293 /* special thing in the current firmware: when length is zero the read-failed */ 314 294 len = dib0700_ctrl_rd(d, st->buf, msg[i].len + 2, 315 - msg[i+1].buf, msg[i+1].len); 295 + st->buf, msg[i + 1].len); 316 296 if (len <= 0) { 317 297 deb_info("I2C read failed on address 0x%02x\n", 318 298 msg[i].addr); 319 299 break; 320 300 } 301 + 302 + if (msg[i + 1].len > sizeof(st->buf)) { 303 + deb_info("i2c xfer buffer to small for %d\n", 304 + msg[i].len); 305 + return -EIO; 306 + } 307 + memcpy(msg[i + 1].buf, st->buf, msg[i + 1].len); 321 308 322 309 msg[i+1].len = len; 323 310

+13 -12

drivers/media/usb/dvb-usb/dib0700_devices.c

··· 508 508 509 509 #define DEFAULT_RC_INTERVAL 50 510 510 511 - static u8 rc_request[] = { REQUEST_POLL_RC, 0 }; 512 - 513 511 /* 514 512 * This function is used only when firmware is < 1.20 version. Newer 515 513 * firmwares use bulk mode, with functions implemented at dib0700_core, ··· 515 517 */ 516 518 static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d) 517 519 { 518 - u8 key[4]; 519 520 enum rc_type protocol; 520 521 u32 scancode; 521 522 u8 toggle; ··· 529 532 return 0; 530 533 } 531 534 532 - i = dib0700_ctrl_rd(d, rc_request, 2, key, 4); 535 + st->buf[0] = REQUEST_POLL_RC; 536 + st->buf[1] = 0; 537 + 538 + i = dib0700_ctrl_rd(d, st->buf, 2, st->buf, 4); 533 539 if (i <= 0) { 534 540 err("RC Query Failed"); 535 - return -1; 541 + return -EIO; 536 542 } 537 543 538 544 /* losing half of KEY_0 events from Philipps rc5 remotes.. */ 539 - if (key[0] == 0 && key[1] == 0 && key[2] == 0 && key[3] == 0) 545 + if (st->buf[0] == 0 && st->buf[1] == 0 546 + && st->buf[2] == 0 && st->buf[3] == 0) 540 547 return 0; 541 548 542 - /* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)key[3-2],(int)key[3-3],(int)key[3-1],(int)key[3]); */ 549 + /* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)st->buf[3 - 2],(int)st->buf[3 - 3],(int)st->buf[3 - 1],(int)st->buf[3]); */ 543 550 544 551 dib0700_rc_setup(d, NULL); /* reset ir sensor data to prevent false events */ 545 552 546 553 switch (d->props.rc.core.protocol) { 547 554 case RC_BIT_NEC: 548 555 /* NEC protocol sends repeat code as 0 0 0 FF */ 549 - if ((key[3-2] == 0x00) && (key[3-3] == 0x00) && 550 - (key[3] == 0xff)) { 556 + if ((st->buf[3 - 2] == 0x00) && (st->buf[3 - 3] == 0x00) && 557 + (st->buf[3] == 0xff)) { 551 558 rc_repeat(d->rc_dev); 552 559 return 0; 553 560 } 554 561 555 562 protocol = RC_TYPE_NEC; 556 - scancode = RC_SCANCODE_NEC(key[3-2], key[3-3]); 563 + scancode = RC_SCANCODE_NEC(st->buf[3 - 2], st->buf[3 - 3]); 557 564 toggle = 0; 558 565 break; 559 566 560 567 default: 561 568 /* RC-5 protocol changes toggle bit on new keypress */ 562 569 protocol = RC_TYPE_RC5; 563 - scancode = RC_SCANCODE_RC5(key[3-2], key[3-3]); 564 - toggle = key[3-1]; 570 + scancode = RC_SCANCODE_RC5(st->buf[3 - 2], st->buf[3 - 3]); 571 + toggle = st->buf[3 - 1]; 565 572 break; 566 573 } 567 574

+88 -27

drivers/media/usb/dvb-usb/dibusb-common.c

··· 62 62 63 63 int dibusb_power_ctrl(struct dvb_usb_device *d, int onoff) 64 64 { 65 - u8 b[3]; 65 + u8 *b; 66 66 int ret; 67 + 68 + b = kmalloc(3, GFP_KERNEL); 69 + if (!b) 70 + return -ENOMEM; 71 + 67 72 b[0] = DIBUSB_REQ_SET_IOCTL; 68 73 b[1] = DIBUSB_IOCTL_CMD_POWER_MODE; 69 74 b[2] = onoff ? DIBUSB_IOCTL_POWER_WAKEUP : DIBUSB_IOCTL_POWER_SLEEP; 70 - ret = dvb_usb_generic_write(d,b,3); 75 + 76 + ret = dvb_usb_generic_write(d, b, 3); 77 + 78 + kfree(b); 79 + 71 80 msleep(10); 81 + 72 82 return ret; 73 83 } 74 84 EXPORT_SYMBOL(dibusb_power_ctrl); 75 85 76 86 int dibusb2_0_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) 77 87 { 78 - u8 b[3] = { 0 }; 79 88 int ret; 89 + u8 *b; 90 + 91 + b = kmalloc(3, GFP_KERNEL); 92 + if (!b) 93 + return -ENOMEM; 80 94 81 95 if ((ret = dibusb_streaming_ctrl(adap,onoff)) < 0) 82 - return ret; 96 + goto ret; 83 97 84 98 if (onoff) { 85 99 b[0] = DIBUSB_REQ_SET_STREAMING_MODE; 86 100 b[1] = 0x00; 87 - if ((ret = dvb_usb_generic_write(adap->dev,b,2)) < 0) 88 - return ret; 101 + ret = dvb_usb_generic_write(adap->dev, b, 2); 102 + if (ret < 0) 103 + goto ret; 89 104 } 90 105 91 106 b[0] = DIBUSB_REQ_SET_IOCTL; 92 107 b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM; 93 - return dvb_usb_generic_write(adap->dev,b,3); 108 + ret = dvb_usb_generic_write(adap->dev, b, 3); 109 + 110 + ret: 111 + kfree(b); 112 + return ret; 94 113 } 95 114 EXPORT_SYMBOL(dibusb2_0_streaming_ctrl); 96 115 97 116 int dibusb2_0_power_ctrl(struct dvb_usb_device *d, int onoff) 98 117 { 99 - if (onoff) { 100 - u8 b[3] = { DIBUSB_REQ_SET_IOCTL, DIBUSB_IOCTL_CMD_POWER_MODE, DIBUSB_IOCTL_POWER_WAKEUP }; 101 - return dvb_usb_generic_write(d,b,3); 102 - } else 118 + u8 *b; 119 + int ret; 120 + 121 + if (!onoff) 103 122 return 0; 123 + 124 + b = kmalloc(3, GFP_KERNEL); 125 + if (!b) 126 + return -ENOMEM; 127 + 128 + b[0] = DIBUSB_REQ_SET_IOCTL; 129 + b[1] = DIBUSB_IOCTL_CMD_POWER_MODE; 130 + b[2] = DIBUSB_IOCTL_POWER_WAKEUP; 131 + 132 + ret = dvb_usb_generic_write(d, b, 3); 133 + 134 + kfree(b); 135 + 136 + return ret; 104 137 } 105 138 EXPORT_SYMBOL(dibusb2_0_power_ctrl); 106 139 107 140 static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr, 108 141 u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen) 109 142 { 110 - u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */ 111 - /* write only ? */ 112 - int wo = (rbuf == NULL || rlen == 0), 113 - len = 2 + wlen + (wo ? 0 : 2); 143 + u8 *sndbuf; 144 + int ret, wo, len; 114 145 115 - if (4 + wlen > sizeof(sndbuf)) { 146 + /* write only ? */ 147 + wo = (rbuf == NULL || rlen == 0); 148 + 149 + len = 2 + wlen + (wo ? 0 : 2); 150 + 151 + sndbuf = kmalloc(MAX_XFER_SIZE, GFP_KERNEL); 152 + if (!sndbuf) 153 + return -ENOMEM; 154 + 155 + if (4 + wlen > MAX_XFER_SIZE) { 116 156 warn("i2c wr: len=%d is too big!\n", wlen); 117 - return -EOPNOTSUPP; 157 + ret = -EOPNOTSUPP; 158 + goto ret; 118 159 } 119 160 120 161 sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ; 121 162 sndbuf[1] = (addr << 1) | (wo ? 0 : 1); 122 163 123 - memcpy(&sndbuf[2],wbuf,wlen); 164 + memcpy(&sndbuf[2], wbuf, wlen); 124 165 125 166 if (!wo) { 126 - sndbuf[wlen+2] = (rlen >> 8) & 0xff; 127 - sndbuf[wlen+3] = rlen & 0xff; 167 + sndbuf[wlen + 2] = (rlen >> 8) & 0xff; 168 + sndbuf[wlen + 3] = rlen & 0xff; 128 169 } 129 170 130 - return dvb_usb_generic_rw(d,sndbuf,len,rbuf,rlen,0); 171 + ret = dvb_usb_generic_rw(d, sndbuf, len, rbuf, rlen, 0); 172 + 173 + ret: 174 + kfree(sndbuf); 175 + return ret; 131 176 } 132 177 133 178 /* ··· 364 319 365 320 int dibusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state) 366 321 { 367 - u8 key[5],cmd = DIBUSB_REQ_POLL_REMOTE; 368 - dvb_usb_generic_rw(d,&cmd,1,key,5,0); 369 - dvb_usb_nec_rc_key_to_event(d,key,event,state); 370 - if (key[0] != 0) 371 - deb_info("key: %*ph\n", 5, key); 372 - return 0; 322 + u8 *buf; 323 + int ret; 324 + 325 + buf = kmalloc(5, GFP_KERNEL); 326 + if (!buf) 327 + return -ENOMEM; 328 + 329 + buf[0] = DIBUSB_REQ_POLL_REMOTE; 330 + 331 + ret = dvb_usb_generic_rw(d, buf, 1, buf, 5, 0); 332 + if (ret < 0) 333 + goto ret; 334 + 335 + dvb_usb_nec_rc_key_to_event(d, buf, event, state); 336 + 337 + if (buf[0] != 0) 338 + deb_info("key: %*ph\n", 5, buf); 339 + 340 + kfree(buf); 341 + 342 + ret: 343 + return ret; 373 344 } 374 345 EXPORT_SYMBOL(dibusb_rc_query);

+3

drivers/media/usb/dvb-usb/dibusb.h

··· 96 96 #define DIBUSB_IOCTL_CMD_ENABLE_STREAM 0x01 97 97 #define DIBUSB_IOCTL_CMD_DISABLE_STREAM 0x02 98 98 99 + /* Max transfer size done by I2C transfer functions */ 100 + #define MAX_XFER_SIZE 64 101 + 99 102 struct dibusb_state { 100 103 struct dib_fe_xfer_ops ops; 101 104 int mt2060_present;

+15 -11

drivers/media/usb/dvb-usb/digitv.c

··· 28 28 static int digitv_ctrl_msg(struct dvb_usb_device *d, 29 29 u8 cmd, u8 vv, u8 *wbuf, int wlen, u8 *rbuf, int rlen) 30 30 { 31 - int wo = (rbuf == NULL || rlen == 0); /* write-only */ 32 - u8 sndbuf[7],rcvbuf[7]; 33 - memset(sndbuf,0,7); memset(rcvbuf,0,7); 31 + struct digitv_state *st = d->priv; 32 + int ret, wo; 34 33 35 - sndbuf[0] = cmd; 36 - sndbuf[1] = vv; 37 - sndbuf[2] = wo ? wlen : rlen; 34 + wo = (rbuf == NULL || rlen == 0); /* write-only */ 35 + 36 + memset(st->sndbuf, 0, 7); 37 + memset(st->rcvbuf, 0, 7); 38 + 39 + st->sndbuf[0] = cmd; 40 + st->sndbuf[1] = vv; 41 + st->sndbuf[2] = wo ? wlen : rlen; 38 42 39 43 if (wo) { 40 - memcpy(&sndbuf[3],wbuf,wlen); 41 - dvb_usb_generic_write(d,sndbuf,7); 44 + memcpy(&st->sndbuf[3], wbuf, wlen); 45 + ret = dvb_usb_generic_write(d, st->sndbuf, 7); 42 46 } else { 43 - dvb_usb_generic_rw(d,sndbuf,7,rcvbuf,7,10); 44 - memcpy(rbuf,&rcvbuf[3],rlen); 47 + ret = dvb_usb_generic_rw(d, st->sndbuf, 7, st->rcvbuf, 7, 10); 48 + memcpy(rbuf, &st->rcvbuf[3], rlen); 45 49 } 46 - return 0; 50 + return ret; 47 51 } 48 52 49 53 /* I2C */

+4 -1

drivers/media/usb/dvb-usb/digitv.h

··· 5 5 #include "dvb-usb.h" 6 6 7 7 struct digitv_state { 8 - int is_nxt6000; 8 + int is_nxt6000; 9 + 10 + unsigned char sndbuf[7]; 11 + unsigned char rcvbuf[7]; 9 12 }; 10 13 11 14 /* protocol (from usblogging and the SDK:

+88 -40

drivers/media/usb/dvb-usb/dtt200u-fe.c

··· 18 18 19 19 struct dtv_frontend_properties fep; 20 20 struct dvb_frontend frontend; 21 + 22 + unsigned char data[80]; 23 + struct mutex data_mutex; 21 24 }; 22 25 23 26 static int dtt200u_fe_read_status(struct dvb_frontend *fe, 24 27 enum fe_status *stat) 25 28 { 26 29 struct dtt200u_fe_state *state = fe->demodulator_priv; 27 - u8 st = GET_TUNE_STATUS, b[3]; 30 + int ret; 28 31 29 - dvb_usb_generic_rw(state->d,&st,1,b,3,0); 32 + mutex_lock(&state->data_mutex); 33 + state->data[0] = GET_TUNE_STATUS; 30 34 31 - switch (b[0]) { 35 + ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 3, 0); 36 + if (ret < 0) { 37 + *stat = 0; 38 + mutex_unlock(&state->data_mutex); 39 + return ret; 40 + } 41 + 42 + switch (state->data[0]) { 32 43 case 0x01: 33 44 *stat = FE_HAS_SIGNAL | FE_HAS_CARRIER | 34 45 FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK; ··· 52 41 *stat = 0; 53 42 break; 54 43 } 44 + mutex_unlock(&state->data_mutex); 55 45 return 0; 56 46 } 57 47 58 48 static int dtt200u_fe_read_ber(struct dvb_frontend* fe, u32 *ber) 59 49 { 60 50 struct dtt200u_fe_state *state = fe->demodulator_priv; 61 - u8 bw = GET_VIT_ERR_CNT,b[3]; 62 - dvb_usb_generic_rw(state->d,&bw,1,b,3,0); 63 - *ber = (b[0] << 16) | (b[1] << 8) | b[2]; 64 - return 0; 51 + int ret; 52 + 53 + mutex_lock(&state->data_mutex); 54 + state->data[0] = GET_VIT_ERR_CNT; 55 + 56 + ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 3, 0); 57 + if (ret >= 0) 58 + *ber = (state->data[0] << 16) | (state->data[1] << 8) | state->data[2]; 59 + 60 + mutex_unlock(&state->data_mutex); 61 + return ret; 65 62 } 66 63 67 64 static int dtt200u_fe_read_unc_blocks(struct dvb_frontend* fe, u32 *unc) 68 65 { 69 66 struct dtt200u_fe_state *state = fe->demodulator_priv; 70 - u8 bw = GET_RS_UNCOR_BLK_CNT,b[2]; 67 + int ret; 71 68 72 - dvb_usb_generic_rw(state->d,&bw,1,b,2,0); 73 - *unc = (b[0] << 8) | b[1]; 74 - return 0; 69 + mutex_lock(&state->data_mutex); 70 + state->data[0] = GET_RS_UNCOR_BLK_CNT; 71 + 72 + ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 2, 0); 73 + if (ret >= 0) 74 + *unc = (state->data[0] << 8) | state->data[1]; 75 + 76 + mutex_unlock(&state->data_mutex); 77 + return ret; 75 78 } 76 79 77 80 static int dtt200u_fe_read_signal_strength(struct dvb_frontend* fe, u16 *strength) 78 81 { 79 82 struct dtt200u_fe_state *state = fe->demodulator_priv; 80 - u8 bw = GET_AGC, b; 81 - dvb_usb_generic_rw(state->d,&bw,1,&b,1,0); 82 - *strength = (b << 8) | b; 83 - return 0; 83 + int ret; 84 + 85 + mutex_lock(&state->data_mutex); 86 + state->data[0] = GET_AGC; 87 + 88 + ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 1, 0); 89 + if (ret >= 0) 90 + *strength = (state->data[0] << 8) | state->data[0]; 91 + 92 + mutex_unlock(&state->data_mutex); 93 + return ret; 84 94 } 85 95 86 96 static int dtt200u_fe_read_snr(struct dvb_frontend* fe, u16 *snr) 87 97 { 88 98 struct dtt200u_fe_state *state = fe->demodulator_priv; 89 - u8 bw = GET_SNR,br; 90 - dvb_usb_generic_rw(state->d,&bw,1,&br,1,0); 91 - *snr = ~((br << 8) | br); 92 - return 0; 99 + int ret; 100 + 101 + mutex_lock(&state->data_mutex); 102 + state->data[0] = GET_SNR; 103 + 104 + ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 1, 0); 105 + if (ret >= 0) 106 + *snr = ~((state->data[0] << 8) | state->data[0]); 107 + 108 + mutex_unlock(&state->data_mutex); 109 + return ret; 93 110 } 94 111 95 112 static int dtt200u_fe_init(struct dvb_frontend* fe) 96 113 { 97 114 struct dtt200u_fe_state *state = fe->demodulator_priv; 98 - u8 b = SET_INIT; 99 - return dvb_usb_generic_write(state->d,&b,1); 115 + int ret; 116 + 117 + mutex_lock(&state->data_mutex); 118 + state->data[0] = SET_INIT; 119 + 120 + ret = dvb_usb_generic_write(state->d, state->data, 1); 121 + mutex_unlock(&state->data_mutex); 122 + 123 + return ret; 100 124 } 101 125 102 126 static int dtt200u_fe_sleep(struct dvb_frontend* fe) ··· 151 105 { 152 106 struct dtv_frontend_properties *fep = &fe->dtv_property_cache; 153 107 struct dtt200u_fe_state *state = fe->demodulator_priv; 154 - int i; 155 - enum fe_status st; 108 + int ret; 156 109 u16 freq = fep->frequency / 250000; 157 - u8 bwbuf[2] = { SET_BANDWIDTH, 0 },freqbuf[3] = { SET_RF_FREQ, 0, 0 }; 158 110 111 + mutex_lock(&state->data_mutex); 112 + state->data[0] = SET_BANDWIDTH; 159 113 switch (fep->bandwidth_hz) { 160 114 case 8000000: 161 - bwbuf[1] = 8; 115 + state->data[1] = 8; 162 116 break; 163 117 case 7000000: 164 - bwbuf[1] = 7; 118 + state->data[1] = 7; 165 119 break; 166 120 case 6000000: 167 - bwbuf[1] = 6; 121 + state->data[1] = 6; 168 122 break; 169 123 default: 170 - return -EINVAL; 124 + ret = -EINVAL; 125 + goto ret; 171 126 } 172 127 173 - dvb_usb_generic_write(state->d,bwbuf,2); 128 + ret = dvb_usb_generic_write(state->d, state->data, 2); 129 + if (ret < 0) 130 + goto ret; 174 131 175 - freqbuf[1] = freq & 0xff; 176 - freqbuf[2] = (freq >> 8) & 0xff; 177 - dvb_usb_generic_write(state->d,freqbuf,3); 132 + state->data[0] = SET_RF_FREQ; 133 + state->data[1] = freq & 0xff; 134 + state->data[2] = (freq >> 8) & 0xff; 135 + ret = dvb_usb_generic_write(state->d, state->data, 3); 136 + if (ret < 0) 137 + goto ret; 178 138 179 - for (i = 0; i < 30; i++) { 180 - msleep(20); 181 - dtt200u_fe_read_status(fe, &st); 182 - if (st & FE_TIMEDOUT) 183 - continue; 184 - } 185 - 186 - return 0; 139 + ret: 140 + mutex_unlock(&state->data_mutex); 141 + return ret; 187 142 } 188 143 189 144 static int dtt200u_fe_get_frontend(struct dvb_frontend* fe, ··· 216 169 deb_info("attaching frontend dtt200u\n"); 217 170 218 171 state->d = d; 172 + mutex_init(&state->data_mutex); 219 173 220 174 memcpy(&state->frontend.ops,&dtt200u_fe_ops,sizeof(struct dvb_frontend_ops)); 221 175 state->frontend.demodulator_priv = state;

+88 -32

drivers/media/usb/dvb-usb/dtt200u.c

··· 20 20 21 21 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr); 22 22 23 + struct dtt200u_state { 24 + unsigned char data[80]; 25 + struct mutex data_mutex; 26 + }; 27 + 23 28 static int dtt200u_power_ctrl(struct dvb_usb_device *d, int onoff) 24 29 { 25 - u8 b = SET_INIT; 30 + struct dtt200u_state *st = d->priv; 31 + int ret = 0; 32 + 33 + mutex_lock(&st->data_mutex); 34 + 35 + st->data[0] = SET_INIT; 26 36 27 37 if (onoff) 28 - dvb_usb_generic_write(d,&b,2); 38 + ret = dvb_usb_generic_write(d, st->data, 2); 29 39 30 - return 0; 40 + mutex_unlock(&st->data_mutex); 41 + return ret; 31 42 } 32 43 33 44 static int dtt200u_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) 34 45 { 35 - u8 b_streaming[2] = { SET_STREAMING, onoff }; 36 - u8 b_rst_pid = RESET_PID_FILTER; 46 + struct dtt200u_state *st = adap->dev->priv; 47 + int ret; 37 48 38 - dvb_usb_generic_write(adap->dev, b_streaming, 2); 49 + mutex_lock(&st->data_mutex); 50 + st->data[0] = SET_STREAMING; 51 + st->data[1] = onoff; 39 52 40 - if (onoff == 0) 41 - dvb_usb_generic_write(adap->dev, &b_rst_pid, 1); 42 - return 0; 53 + ret = dvb_usb_generic_write(adap->dev, st->data, 2); 54 + if (ret < 0) 55 + goto ret; 56 + 57 + if (onoff) 58 + goto ret; 59 + 60 + st->data[0] = RESET_PID_FILTER; 61 + ret = dvb_usb_generic_write(adap->dev, st->data, 1); 62 + 63 + ret: 64 + mutex_unlock(&st->data_mutex); 65 + 66 + return ret; 43 67 } 44 68 45 69 static int dtt200u_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid, int onoff) 46 70 { 47 - u8 b_pid[4]; 71 + struct dtt200u_state *st = adap->dev->priv; 72 + int ret; 73 + 48 74 pid = onoff ? pid : 0; 49 75 50 - b_pid[0] = SET_PID_FILTER; 51 - b_pid[1] = index; 52 - b_pid[2] = pid & 0xff; 53 - b_pid[3] = (pid >> 8) & 0x1f; 76 + mutex_lock(&st->data_mutex); 77 + st->data[0] = SET_PID_FILTER; 78 + st->data[1] = index; 79 + st->data[2] = pid & 0xff; 80 + st->data[3] = (pid >> 8) & 0x1f; 54 81 55 - return dvb_usb_generic_write(adap->dev, b_pid, 4); 82 + ret = dvb_usb_generic_write(adap->dev, st->data, 4); 83 + mutex_unlock(&st->data_mutex); 84 + 85 + return ret; 56 86 } 57 87 58 88 static int dtt200u_rc_query(struct dvb_usb_device *d) 59 89 { 60 - u8 key[5],cmd = GET_RC_CODE; 90 + struct dtt200u_state *st = d->priv; 61 91 u32 scancode; 92 + int ret; 62 93 63 - dvb_usb_generic_rw(d,&cmd,1,key,5,0); 64 - if (key[0] == 1) { 94 + mutex_lock(&st->data_mutex); 95 + st->data[0] = GET_RC_CODE; 96 + 97 + ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 5, 0); 98 + if (ret < 0) 99 + goto ret; 100 + 101 + if (st->data[0] == 1) { 65 102 enum rc_type proto = RC_TYPE_NEC; 66 103 67 - scancode = key[1]; 68 - if ((u8) ~key[1] != key[2]) { 104 + scancode = st->data[1]; 105 + if ((u8) ~st->data[1] != st->data[2]) { 69 106 /* Extended NEC */ 70 107 scancode = scancode << 8; 71 - scancode |= key[2]; 108 + scancode |= st->data[2]; 72 109 proto = RC_TYPE_NECX; 73 110 } 74 111 scancode = scancode << 8; 75 - scancode |= key[3]; 112 + scancode |= st->data[3]; 76 113 77 114 /* Check command checksum is ok */ 78 - if ((u8) ~key[3] == key[4]) 115 + if ((u8) ~st->data[3] == st->data[4]) 79 116 rc_keydown(d->rc_dev, proto, scancode, 0); 80 117 else 81 118 rc_keyup(d->rc_dev); 82 - } else if (key[0] == 2) { 119 + } else if (st->data[0] == 2) { 83 120 rc_repeat(d->rc_dev); 84 121 } else { 85 122 rc_keyup(d->rc_dev); 86 123 } 87 124 88 - if (key[0] != 0) 89 - deb_info("key: %*ph\n", 5, key); 125 + if (st->data[0] != 0) 126 + deb_info("st->data: %*ph\n", 5, st->data); 90 127 91 - return 0; 128 + ret: 129 + mutex_unlock(&st->data_mutex); 130 + return ret; 92 131 } 93 132 94 133 static int dtt200u_frontend_attach(struct dvb_usb_adapter *adap) ··· 145 106 static int dtt200u_usb_probe(struct usb_interface *intf, 146 107 const struct usb_device_id *id) 147 108 { 109 + struct dvb_usb_device *d; 110 + struct dtt200u_state *st; 111 + 148 112 if (0 == dvb_usb_device_init(intf, &dtt200u_properties, 149 - THIS_MODULE, NULL, adapter_nr) || 113 + THIS_MODULE, &d, adapter_nr) || 150 114 0 == dvb_usb_device_init(intf, &wt220u_properties, 151 - THIS_MODULE, NULL, adapter_nr) || 115 + THIS_MODULE, &d, adapter_nr) || 152 116 0 == dvb_usb_device_init(intf, &wt220u_fc_properties, 153 - THIS_MODULE, NULL, adapter_nr) || 117 + THIS_MODULE, &d, adapter_nr) || 154 118 0 == dvb_usb_device_init(intf, &wt220u_zl0353_properties, 155 - THIS_MODULE, NULL, adapter_nr) || 119 + THIS_MODULE, &d, adapter_nr) || 156 120 0 == dvb_usb_device_init(intf, &wt220u_miglia_properties, 157 - THIS_MODULE, NULL, adapter_nr)) 121 + THIS_MODULE, &d, adapter_nr)) { 122 + st = d->priv; 123 + mutex_init(&st->data_mutex); 124 + 158 125 return 0; 126 + } 159 127 160 128 return -ENODEV; 161 129 } ··· 185 139 static struct dvb_usb_device_properties dtt200u_properties = { 186 140 .usb_ctrl = CYPRESS_FX2, 187 141 .firmware = "dvb-usb-dtt200u-01.fw", 142 + 143 + .size_of_priv = sizeof(struct dtt200u_state), 188 144 189 145 .num_adapters = 1, 190 146 .adapter = { ··· 238 190 .usb_ctrl = CYPRESS_FX2, 239 191 .firmware = "dvb-usb-wt220u-02.fw", 240 192 193 + .size_of_priv = sizeof(struct dtt200u_state), 194 + 241 195 .num_adapters = 1, 242 196 .adapter = { 243 197 { ··· 289 239 static struct dvb_usb_device_properties wt220u_fc_properties = { 290 240 .usb_ctrl = CYPRESS_FX2, 291 241 .firmware = "dvb-usb-wt220u-fc03.fw", 242 + 243 + .size_of_priv = sizeof(struct dtt200u_state), 292 244 293 245 .num_adapters = 1, 294 246 .adapter = { ··· 342 290 .usb_ctrl = CYPRESS_FX2, 343 291 .firmware = "dvb-usb-wt220u-zl0353-01.fw", 344 292 293 + .size_of_priv = sizeof(struct dtt200u_state), 294 + 345 295 .num_adapters = 1, 346 296 .adapter = { 347 297 { ··· 393 339 static struct dvb_usb_device_properties wt220u_miglia_properties = { 394 340 .usb_ctrl = CYPRESS_FX2, 395 341 .firmware = "dvb-usb-wt220u-miglia-01.fw", 342 + 343 + .size_of_priv = sizeof(struct dtt200u_state), 396 344 397 345 .num_adapters = 1, 398 346 .generic_bulk_ctrl_endpoint = 0x01,

+8 -2

drivers/media/usb/dvb-usb/dtv5100.c

··· 31 31 MODULE_PARM_DESC(debug, "set debugging level" DVB_USB_DEBUG_STATUS); 32 32 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr); 33 33 34 + struct dtv5100_state { 35 + unsigned char data[80]; 36 + }; 37 + 34 38 static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, 35 39 u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen) 36 40 { 41 + struct dtv5100_state *st = d->priv; 37 42 u8 request; 38 43 u8 type; 39 44 u16 value; ··· 65 60 } 66 61 index = (addr << 8) + wbuf[0]; 67 62 63 + memcpy(st->data, rbuf, rlen); 68 64 msleep(1); /* avoid I2C errors */ 69 65 return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request, 70 - type, value, index, rbuf, rlen, 66 + type, value, index, st->data, rlen, 71 67 DTV5100_USB_TIMEOUT); 72 68 } 73 69 ··· 182 176 .caps = DVB_USB_IS_AN_I2C_ADAPTER, 183 177 .usb_ctrl = DEVICE_SPECIFIC, 184 178 185 - .size_of_priv = 0, 179 + .size_of_priv = sizeof(struct dtv5100_state), 186 180 187 181 .num_adapters = 1, 188 182 .adapter = {{

+1 -1

drivers/media/usb/dvb-usb/dw2102.c

··· 852 852 if (i && !state->initialized) { 853 853 state->initialized = 1; 854 854 /* reset board */ 855 - dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0); 855 + return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0); 856 856 } 857 857 858 858 return 0;

+23 -2

drivers/media/usb/dvb-usb/gp8psk.c

··· 24 24 25 25 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr); 26 26 27 + struct gp8psk_state { 28 + unsigned char data[80]; 29 + }; 30 + 27 31 static int gp8psk_get_fw_version(struct dvb_usb_device *d, u8 *fw_vers) 28 32 { 29 33 return (gp8psk_usb_in_op(d, GET_FW_VERS, 0, 0, fw_vers, 6)); ··· 57 53 58 54 int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen) 59 55 { 56 + struct gp8psk_state *st = d->priv; 60 57 int ret = 0,try = 0; 58 + 59 + if (blen > sizeof(st->data)) 60 + return -EIO; 61 61 62 62 if ((ret = mutex_lock_interruptible(&d->usb_mutex))) 63 63 return ret; 64 64 65 65 while (ret >= 0 && ret != blen && try < 3) { 66 + memcpy(st->data, b, blen); 66 67 ret = usb_control_msg(d->udev, 67 68 usb_rcvctrlpipe(d->udev,0), 68 69 req, 69 70 USB_TYPE_VENDOR | USB_DIR_IN, 70 - value,index,b,blen, 71 + value, index, st->data, blen, 71 72 2000); 72 73 deb_info("reading number %d (ret: %d)\n",try,ret); 73 74 try++; ··· 95 86 int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value, 96 87 u16 index, u8 *b, int blen) 97 88 { 89 + struct gp8psk_state *st = d->priv; 98 90 int ret; 99 91 100 92 deb_xfer("out: req. %x, val: %x, ind: %x, buffer: ",req,value,index); 101 93 debug_dump(b,blen,deb_xfer); 102 94 95 + if (blen > sizeof(st->data)) 96 + return -EIO; 97 + 103 98 if ((ret = mutex_lock_interruptible(&d->usb_mutex))) 104 99 return ret; 105 100 101 + memcpy(st->data, b, blen); 106 102 if (usb_control_msg(d->udev, 107 103 usb_sndctrlpipe(d->udev,0), 108 104 req, 109 105 USB_TYPE_VENDOR | USB_DIR_OUT, 110 - value,index,b,blen, 106 + value, index, st->data, blen, 111 107 2000) != blen) { 112 108 warn("usb out operation failed."); 113 109 ret = -EIO; ··· 157 143 err("failed to load bcm4500 firmware."); 158 144 goto out_free; 159 145 } 146 + if (buflen > 64) { 147 + err("firmare chunk size bigger than 64 bytes."); 148 + goto out_free; 149 + } 150 + 160 151 memcpy(buf, ptr, buflen); 161 152 if (dvb_usb_generic_write(d, buf, buflen)) { 162 153 err("failed to load bcm4500 firmware."); ··· 283 264 static struct dvb_usb_device_properties gp8psk_properties = { 284 265 .usb_ctrl = CYPRESS_FX2, 285 266 .firmware = "dvb-usb-gp8psk-01.fw", 267 + 268 + .size_of_priv = sizeof(struct gp8psk_state), 286 269 287 270 .num_adapters = 1, 288 271 .adapter = {

+18 -7

drivers/media/usb/dvb-usb/nova-t-usb2.c

··· 74 74 */ 75 75 static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state) 76 76 { 77 - u8 key[5],cmd[2] = { DIBUSB_REQ_POLL_REMOTE, 0x35 }, data,toggle,custom; 77 + u8 *buf, data, toggle, custom; 78 78 u16 raw; 79 - int i; 79 + int i, ret; 80 80 struct dibusb_device_state *st = d->priv; 81 81 82 - dvb_usb_generic_rw(d,cmd,2,key,5,0); 82 + buf = kmalloc(5, GFP_KERNEL); 83 + if (!buf) 84 + return -ENOMEM; 85 + 86 + buf[0] = DIBUSB_REQ_POLL_REMOTE; 87 + buf[1] = 0x35; 88 + ret = dvb_usb_generic_rw(d, buf, 2, buf, 5, 0); 89 + if (ret < 0) 90 + goto ret; 83 91 84 92 *state = REMOTE_NO_KEY_PRESSED; 85 - switch (key[0]) { 93 + switch (buf[0]) { 86 94 case DIBUSB_RC_HAUPPAUGE_KEY_PRESSED: 87 - raw = ((key[1] << 8) | key[2]) >> 3; 95 + raw = ((buf[1] << 8) | buf[2]) >> 3; 88 96 toggle = !!(raw & 0x800); 89 97 data = raw & 0x3f; 90 98 custom = (raw >> 6) & 0x1f; 91 99 92 - deb_rc("raw key code 0x%02x, 0x%02x, 0x%02x to c: %02x d: %02x toggle: %d\n",key[1],key[2],key[3],custom,data,toggle); 100 + deb_rc("raw key code 0x%02x, 0x%02x, 0x%02x to c: %02x d: %02x toggle: %d\n", 101 + buf[1], buf[2], buf[3], custom, data, toggle); 93 102 94 103 for (i = 0; i < ARRAY_SIZE(rc_map_haupp_table); i++) { 95 104 if (rc5_data(&rc_map_haupp_table[i]) == data && ··· 126 117 break; 127 118 } 128 119 129 - return 0; 120 + ret: 121 + kfree(buf); 122 + return ret; 130 123 } 131 124 132 125 static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])

+78 -58

drivers/media/usb/dvb-usb/pctv452e.c

··· 97 97 u8 c; /* transaction counter, wraps around... */ 98 98 u8 initialized; /* set to 1 if 0x15 has been sent */ 99 99 u16 last_rc_key; 100 + 101 + unsigned char data[80]; 100 102 }; 101 103 102 104 static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data, 103 105 unsigned int write_len, unsigned int read_len) 104 106 { 105 107 struct pctv452e_state *state = (struct pctv452e_state *)d->priv; 106 - u8 buf[64]; 107 108 u8 id; 108 109 unsigned int rlen; 109 110 int ret; 110 111 111 - BUG_ON(NULL == data && 0 != (write_len | read_len)); 112 - BUG_ON(write_len > 64 - 4); 113 - BUG_ON(read_len > 64 - 4); 112 + if (!data || (write_len > 64 - 4) || (read_len > 64 - 4)) { 113 + err("%s: transfer data invalid", __func__); 114 + return -EIO; 115 + } 114 116 117 + mutex_lock(&state->ca_mutex); 115 118 id = state->c++; 116 119 117 - buf[0] = SYNC_BYTE_OUT; 118 - buf[1] = id; 119 - buf[2] = cmd; 120 - buf[3] = write_len; 120 + state->data[0] = SYNC_BYTE_OUT; 121 + state->data[1] = id; 122 + state->data[2] = cmd; 123 + state->data[3] = write_len; 121 124 122 - memcpy(buf + 4, data, write_len); 125 + memcpy(state->data + 4, data, write_len); 123 126 124 127 rlen = (read_len > 0) ? 64 : 0; 125 - ret = dvb_usb_generic_rw(d, buf, 4 + write_len, 126 - buf, rlen, /* delay_ms */ 0); 128 + ret = dvb_usb_generic_rw(d, state->data, 4 + write_len, 129 + state->data, rlen, /* delay_ms */ 0); 127 130 if (0 != ret) 128 131 goto failed; 129 132 130 133 ret = -EIO; 131 - if (SYNC_BYTE_IN != buf[0] || id != buf[1]) 134 + if (SYNC_BYTE_IN != state->data[0] || id != state->data[1]) 132 135 goto failed; 133 136 134 - memcpy(data, buf + 4, read_len); 137 + memcpy(data, state->data + 4, read_len); 135 138 139 + mutex_unlock(&state->ca_mutex); 136 140 return 0; 137 141 138 142 failed: 139 143 err("CI error %d; %02X %02X %02X -> %*ph.", 140 - ret, SYNC_BYTE_OUT, id, cmd, 3, buf); 144 + ret, SYNC_BYTE_OUT, id, cmd, 3, state->data); 141 145 146 + mutex_unlock(&state->ca_mutex); 142 147 return ret; 143 148 } 144 149 ··· 410 405 u8 *rcv_buf, u8 rcv_len) 411 406 { 412 407 struct pctv452e_state *state = (struct pctv452e_state *)d->priv; 413 - u8 buf[64]; 414 408 u8 id; 415 409 int ret; 416 410 411 + mutex_lock(&state->ca_mutex); 417 412 id = state->c++; 418 413 419 414 ret = -EINVAL; 420 415 if (snd_len > 64 - 7 || rcv_len > 64 - 7) 421 416 goto failed; 422 417 423 - buf[0] = SYNC_BYTE_OUT; 424 - buf[1] = id; 425 - buf[2] = PCTV_CMD_I2C; 426 - buf[3] = snd_len + 3; 427 - buf[4] = addr << 1; 428 - buf[5] = snd_len; 429 - buf[6] = rcv_len; 418 + state->data[0] = SYNC_BYTE_OUT; 419 + state->data[1] = id; 420 + state->data[2] = PCTV_CMD_I2C; 421 + state->data[3] = snd_len + 3; 422 + state->data[4] = addr << 1; 423 + state->data[5] = snd_len; 424 + state->data[6] = rcv_len; 430 425 431 - memcpy(buf + 7, snd_buf, snd_len); 426 + memcpy(state->data + 7, snd_buf, snd_len); 432 427 433 - ret = dvb_usb_generic_rw(d, buf, 7 + snd_len, 434 - buf, /* rcv_len */ 64, 428 + ret = dvb_usb_generic_rw(d, state->data, 7 + snd_len, 429 + state->data, /* rcv_len */ 64, 435 430 /* delay_ms */ 0); 436 431 if (ret < 0) 437 432 goto failed; 438 433 439 434 /* TT USB protocol error. */ 440 435 ret = -EIO; 441 - if (SYNC_BYTE_IN != buf[0] || id != buf[1]) 436 + if (SYNC_BYTE_IN != state->data[0] || id != state->data[1]) 442 437 goto failed; 443 438 444 439 /* I2C device didn't respond as expected. */ 445 440 ret = -EREMOTEIO; 446 - if (buf[5] < snd_len || buf[6] < rcv_len) 441 + if (state->data[5] < snd_len || state->data[6] < rcv_len) 447 442 goto failed; 448 443 449 - memcpy(rcv_buf, buf + 7, rcv_len); 444 + memcpy(rcv_buf, state->data + 7, rcv_len); 445 + mutex_unlock(&state->ca_mutex); 450 446 451 447 return rcv_len; 452 448 453 449 failed: 454 - err("I2C error %d; %02X %02X %02X %02X %02X -> " 455 - "%02X %02X %02X %02X %02X.", 450 + err("I2C error %d; %02X %02X %02X %02X %02X -> %*ph", 456 451 ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len, 457 - buf[0], buf[1], buf[4], buf[5], buf[6]); 452 + 7, state->data); 458 453 454 + mutex_unlock(&state->ca_mutex); 459 455 return ret; 460 456 } 461 457 ··· 505 499 static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i) 506 500 { 507 501 struct pctv452e_state *state = (struct pctv452e_state *)d->priv; 508 - u8 b0[] = { 0xaa, 0, PCTV_CMD_RESET, 1, 0 }; 509 - u8 rx[PCTV_ANSWER_LEN]; 502 + u8 *rx; 510 503 int ret; 511 504 512 505 info("%s: %d\n", __func__, i); ··· 516 511 if (state->initialized) 517 512 return 0; 518 513 514 + rx = kmalloc(PCTV_ANSWER_LEN, GFP_KERNEL); 515 + if (!rx) 516 + return -ENOMEM; 517 + 518 + mutex_lock(&state->ca_mutex); 519 519 /* hmm where shoud this should go? */ 520 520 ret = usb_set_interface(d->udev, 0, ISOC_INTERFACE_ALTERNATIVE); 521 521 if (ret != 0) ··· 528 518 __func__, ret); 529 519 530 520 /* this is a one-time initialization, dont know where to put */ 531 - b0[1] = state->c++; 521 + state->data[0] = 0xaa; 522 + state->data[1] = state->c++; 523 + state->data[2] = PCTV_CMD_RESET; 524 + state->data[3] = 1; 525 + state->data[4] = 0; 532 526 /* reset board */ 533 - ret = dvb_usb_generic_rw(d, b0, sizeof(b0), rx, PCTV_ANSWER_LEN, 0); 527 + ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0); 534 528 if (ret) 535 - return ret; 529 + goto ret; 536 530 537 - b0[1] = state->c++; 538 - b0[4] = 1; 531 + state->data[1] = state->c++; 532 + state->data[4] = 1; 539 533 /* reset board (again?) */ 540 - ret = dvb_usb_generic_rw(d, b0, sizeof(b0), rx, PCTV_ANSWER_LEN, 0); 534 + ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0); 541 535 if (ret) 542 - return ret; 536 + goto ret; 543 537 544 538 state->initialized = 1; 545 539 546 - return 0; 540 + ret: 541 + mutex_unlock(&state->ca_mutex); 542 + kfree(rx); 543 + return ret; 547 544 } 548 545 549 546 static int pctv452e_rc_query(struct dvb_usb_device *d) 550 547 { 551 548 struct pctv452e_state *state = (struct pctv452e_state *)d->priv; 552 - u8 b[CMD_BUFFER_SIZE]; 553 - u8 rx[PCTV_ANSWER_LEN]; 554 549 int ret, i; 555 - u8 id = state->c++; 550 + u8 id; 551 + 552 + mutex_lock(&state->ca_mutex); 553 + id = state->c++; 556 554 557 555 /* prepare command header */ 558 - b[0] = SYNC_BYTE_OUT; 559 - b[1] = id; 560 - b[2] = PCTV_CMD_IR; 561 - b[3] = 0; 556 + state->data[0] = SYNC_BYTE_OUT; 557 + state->data[1] = id; 558 + state->data[2] = PCTV_CMD_IR; 559 + state->data[3] = 0; 562 560 563 561 /* send ir request */ 564 - ret = dvb_usb_generic_rw(d, b, 4, rx, PCTV_ANSWER_LEN, 0); 562 + ret = dvb_usb_generic_rw(d, state->data, 4, 563 + state->data, PCTV_ANSWER_LEN, 0); 565 564 if (ret != 0) 566 - return ret; 565 + goto ret; 567 566 568 567 if (debug > 3) { 569 - info("%s: read: %2d: %*ph: ", __func__, ret, 3, rx); 570 - for (i = 0; (i < rx[3]) && ((i+3) < PCTV_ANSWER_LEN); i++) 571 - info(" %02x", rx[i+3]); 568 + info("%s: read: %2d: %*ph: ", __func__, ret, 3, state->data); 569 + for (i = 0; (i < state->data[3]) && ((i + 3) < PCTV_ANSWER_LEN); i++) 570 + info(" %02x", state->data[i + 3]); 572 571 573 572 info("\n"); 574 573 } 575 574 576 - if ((rx[3] == 9) && (rx[12] & 0x01)) { 575 + if ((state->data[3] == 9) && (state->data[12] & 0x01)) { 577 576 /* got a "press" event */ 578 - state->last_rc_key = RC_SCANCODE_RC5(rx[7], rx[6]); 577 + state->last_rc_key = RC_SCANCODE_RC5(state->data[7], state->data[6]); 579 578 if (debug > 2) 580 579 info("%s: cmd=0x%02x sys=0x%02x\n", 581 - __func__, rx[6], rx[7]); 580 + __func__, state->data[6], state->data[7]); 582 581 583 582 rc_keydown(d->rc_dev, RC_TYPE_RC5, state->last_rc_key, 0); 584 583 } else if (state->last_rc_key) { 585 584 rc_keyup(d->rc_dev); 586 585 state->last_rc_key = 0; 587 586 } 588 - 589 - return 0; 587 + ret: 588 + mutex_unlock(&state->ca_mutex); 589 + return ret; 590 590 } 591 591 592 592 static int pctv452e_read_mac_address(struct dvb_usb_device *d, u8 mac[6])

+11 -5

drivers/media/usb/dvb-usb/technisat-usb2.c

··· 89 89 static int technisat_usb2_i2c_access(struct usb_device *udev, 90 90 u8 device_addr, u8 *tx, u8 txlen, u8 *rx, u8 rxlen) 91 91 { 92 - u8 b[64]; 92 + u8 *b; 93 93 int ret, actual_length; 94 + 95 + b = kmalloc(64, GFP_KERNEL); 96 + if (!b) 97 + return -ENOMEM; 94 98 95 99 deb_i2c("i2c-access: %02x, tx: ", device_addr); 96 100 debug_dump(tx, txlen, deb_i2c); ··· 127 123 128 124 if (ret < 0) { 129 125 err("i2c-error: out failed %02x = %d", device_addr, ret); 130 - return -ENODEV; 126 + goto err; 131 127 } 132 128 133 129 ret = usb_bulk_msg(udev, ··· 135 131 b, 64, &actual_length, 1000); 136 132 if (ret < 0) { 137 133 err("i2c-error: in failed %02x = %d", device_addr, ret); 138 - return -ENODEV; 134 + goto err; 139 135 } 140 136 141 137 if (b[0] != I2C_STATUS_OK) { ··· 144 140 if (!(b[0] == I2C_STATUS_NAK && 145 141 device_addr == 0x60 146 142 /* && device_is_technisat_usb2 */)) 147 - return -ENODEV; 143 + goto err; 148 144 } 149 145 150 146 deb_i2c("status: %d, ", b[0]); ··· 158 154 159 155 deb_i2c("\n"); 160 156 161 - return 0; 157 + err: 158 + kfree(b); 159 + return ret; 162 160 } 163 161 164 162 static int technisat_usb2_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,

+13 -2

drivers/media/usb/s2255/s2255drv.c

··· 1901 1901 s32 TransferBufferLength, int bOut) 1902 1902 { 1903 1903 int r; 1904 + unsigned char *buf; 1905 + 1906 + buf = kmalloc(TransferBufferLength, GFP_KERNEL); 1907 + if (!buf) 1908 + return -ENOMEM; 1909 + 1904 1910 if (!bOut) { 1905 1911 r = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), 1906 1912 Request, 1907 1913 USB_TYPE_VENDOR | USB_RECIP_DEVICE | 1908 1914 USB_DIR_IN, 1909 - Value, Index, TransferBuffer, 1915 + Value, Index, buf, 1910 1916 TransferBufferLength, HZ * 5); 1917 + 1918 + if (r >= 0) 1919 + memcpy(TransferBuffer, buf, TransferBufferLength); 1911 1920 } else { 1921 + memcpy(buf, TransferBuffer, TransferBufferLength); 1912 1922 r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), 1913 1923 Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE, 1914 - Value, Index, TransferBuffer, 1924 + Value, Index, buf, 1915 1925 TransferBufferLength, HZ * 5); 1916 1926 } 1927 + kfree(buf); 1917 1928 return r; 1918 1929 } 1919 1930

+11 -5

drivers/media/usb/stkwebcam/stk-webcam.c

··· 147 147 int stk_camera_read_reg(struct stk_camera *dev, u16 index, int *value) 148 148 { 149 149 struct usb_device *udev = dev->udev; 150 + unsigned char *buf; 150 151 int ret; 152 + 153 + buf = kmalloc(sizeof(u8), GFP_KERNEL); 154 + if (!buf) 155 + return -ENOMEM; 151 156 152 157 ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 153 158 0x00, 154 159 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 155 160 0x00, 156 161 index, 157 - (u8 *) value, 162 + buf, 158 163 sizeof(u8), 159 164 500); 160 - if (ret < 0) 161 - return ret; 162 - else 163 - return 0; 165 + if (ret >= 0) 166 + memcpy(value, buf, sizeof(u8)); 167 + 168 + kfree(buf); 169 + return ret; 164 170 } 165 171 166 172 static int stk_start_stream(struct stk_camera *dev)

+2

drivers/staging/media/bcm2048/radio-bcm2048.c

··· 482 482 flags); 483 483 memset(&bdev->rds_info, 0, sizeof(bdev->rds_info)); 484 484 } 485 + if (err) 486 + return err; 485 487 486 488 return bcm2048_send_command(bdev, BCM2048_I2C_FM_RDS_SYSTEM, 487 489 bdev->cache_fm_rds_system);

Configure Feed

Configure Feed