V4L/DVB (12845): tm6000: more buffer handling fixes

Before this patch, we were writing outside vmalloced buffer

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 34 insertions, 15 deletions

diff --git a/drivers/staging/tm6000/tm6000-video.c b/drivers/staging/tm6000/tm6000-video.c
index 3723d83..932dfde 100644
--- a/drivers/staging/tm6000/tm6000-video.c
+++ b/drivers/staging/tm6000/tm6000-video.c
@@ -273,6 +273,11 @@ static int copy_packet(struct urb *urb, u32 header, u8 **ptr, u8 *endp,
 					get_next_buf (dma_q, buf);
 					if (!*buf)
 						return rc;
+					out_p = videobuf_to_vmalloc(&((*buf)->vb));
+					if (!out_p)
+						return rc;
+
+					pos = dev->isoc_ctl.pos = 0;
 				}
 			}
 
@@ -420,6 +425,10 @@ static int copy_multiplexed(u8 *ptr, u8 *out_p, unsigned long len,
 			get_next_buf (dma_q, buf);
 			if (!*buf)
 				break;
+			out_p = videobuf_to_vmalloc(&((*buf)->vb));
+			if (!out_p)
+				return rc;
+			pos = 0;
 		}
 	}
 
@@ -471,16 +480,25 @@ static void inline print_err_status (struct tm6000_core *dev,
 /*
  * Controls the isoc copy of each urb packet
  */
-static inline int tm6000_isoc_copy(struct urb *urb, struct tm6000_buffer **buf)
+static inline int tm6000_isoc_copy(struct urb *urb)
 {
 	struct tm6000_dmaqueue  *dma_q = urb->context;
 	struct tm6000_core *dev= container_of(dma_q,struct tm6000_core,vidq);
-	void *outp=videobuf_to_vmalloc (&((*buf)->vb));
+	struct tm6000_buffer *buf;
 	int i, len=0, rc=1;
-	int size=(*buf)->vb.size;
-	char *p;
+	int size;
+	char *outp = NULL, *p;
 	unsigned long copied;
 
+	get_next_buf(dma_q, &buf);
+	if (!buf)
+		outp = videobuf_to_vmalloc(&buf->vb);
+
+	if (!outp)
+		return 0;
+
+	size = buf->vb.size;
+
 	copied=0;
 
 	if (urb->status<0) {
@@ -501,12 +519,12 @@ static inline int tm6000_isoc_copy(struct urb *urb, struct tm6000_buffer **buf)
 //		if (len>=TM6000_URB_MSG_LEN) {
 			p=urb->transfer_buffer + urb->iso_frame_desc[i].offset;
 			if (!urb->iso_frame_desc[i].status) {
-				if (((*buf)->fmt->fourcc)==V4L2_PIX_FMT_TM6000) {
-					rc=copy_multiplexed(p,outp,len,urb,buf);
+				if ((buf->fmt->fourcc)==V4L2_PIX_FMT_TM6000) {
+					rc=copy_multiplexed(p, outp, len, urb, &buf);
 					if (rc<=0)
 						return rc;
 				} else {
-					copy_streams(p,outp,len,urb,buf);
+					copy_streams(p, outp, len, urb, &buf);
 				}
 			}
 			copied += len;
@@ -526,21 +544,22 @@ static inline int tm6000_isoc_copy(struct urb *urb, struct tm6000_buffer **buf)
  */
 static void tm6000_irq_callback(struct urb *urb)
 {
-	struct tm6000_buffer    *buf = NULL;
 	struct tm6000_dmaqueue  *dma_q = urb->context;
 	struct tm6000_core *dev = container_of(dma_q, struct tm6000_core, vidq);
-	unsigned long flags;
+	int i;
 
 	if (!dev)
 		return;
 
-	spin_lock_irqsave(&dev->slock, flags);
-
-	get_next_buf(dma_q, &buf);
-	if (buf)
-		 tm6000_isoc_copy(urb, &buf);
-	spin_unlock_irqrestore(&dev->slock, flags);
+	spin_lock(&dev->slock);
+	tm6000_isoc_copy(urb);
+	spin_unlock(&dev->slock);
 
+	/* Reset urb buffers */
+	for (i = 0; i < urb->number_of_packets; i++) {
+		urb->iso_frame_desc[i].status = 0;
+		urb->iso_frame_desc[i].actual_length = 0;
+	}
 
 	urb->status = usb_submit_urb(urb, GFP_ATOMIC);
 	if (urb->status)