From 8c441616f67011244cb15bc1a3dda6fd8706ecd2 Mon Sep 17 00:00:00 2001
From: David Ellingsworth <da...@identd.dyndns.org>
Date: Sat, 12 Sep 2009 16:04:44 -0400
Subject: [PATCH 08/14] mr800: fix potential use after free

Signed-off-by: David Ellingsworth <da...@identd.dyndns.org>
---
drivers/media/radio/radio-mr800.c |    1 -
1 files changed, 0 insertions(+), 1 deletions(-)

diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 9fd2342..87b58e3 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -274,7 +274,6 @@ static void usb_amradio_disconnect(struct usb_interface *intf)

    usb_set_intfdata(intf, NULL);
    video_unregister_device(&radio->videodev);
-    v4l2_device_disconnect(&radio->v4l2_dev);
}

/* vidioc_querycap - query device capabilities */
--
1.6.3.3

>From 8b5f17aeea6cf394bedd6f9029a57b85555f5815 Mon Sep 17 00:00:00 2001
From: David Ellingsworth <da...@identd.dyndns.org>
Date: Sat, 12 Sep 2009 21:59:07 -0400
Subject: [PATCH 10/14] mr800: ensure the radio is initialized to a
 consistent state

Signed-off-by: David Ellingsworth <da...@identd.dyndns.org>
---
 drivers/media/radio/radio-mr800.c |   34 ++++++++++++++++++++++++++++++++--
 1 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index df020e8..dbf0dbb 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -85,6 +85,9 @@ MODULE_LICENSE("GPL");
 #define amradio_dev_warn(dev, fmt, arg...)				\
 		dev_warn(dev, MR800_DRIVER_NAME " - " fmt, ##arg)
 
+#define amradio_dev_err(dev, fmt, arg...) \
+		dev_err(dev, MR800_DRIVER_NAME " - " fmt, ##arg)
+
 /* Probably USB_TIMEOUT should be modified in module parameter */
 #define BUFFER_LENGTH 8
 #define USB_TIMEOUT 500
@@ -137,6 +140,7 @@ struct amradio_device {
 	int curfreq;
 	int stereo;
 	int muted;
+	int initialized;
 };
 
 #define vdev_to_amradio(r) container_of(r, struct amradio_device, videodev)
@@ -477,6 +481,31 @@ static int vidioc_s_input(struct file *filp, void *priv, unsigned int i)
 	return 0;
 }
 
+static int usb_amradio_init(struct amradio_device *radio)
+{
+	int retval;
+
+	retval = amradio_set_mute(radio, AMRADIO_STOP);
+	if (retval < 0) {
+		amradio_dev_warn(&radio->videodev.dev, "amradio_stop failed\n");
+		goto out_err;
+	}
+
+	retval = amradio_set_stereo(radio, WANT_STEREO);
+	if (retval < 0) {
+		amradio_dev_warn(&radio->videodev.dev, "set stereo failed\n");
+		goto out_err;
+	}
+
+	radio->initialized = 1;
+	goto out;
+
+out_err:
+	amradio_dev_err(&radio->videodev.dev, "initialization failed\n");
+out:
+	return retval;
+}
+
 /* open device - amradio_start() and amradio_setfreq() */
 static int usb_amradio_open(struct file *file)
 {
@@ -492,6 +521,9 @@ static int usb_amradio_open(struct file *file)
 
 	file->private_data = radio;
 
+	if (unlikely(!radio->initialized))
+		retval = usb_amradio_init(radio);
+
 unlock:
 	mutex_unlock(&radio->lock);
 	return retval;
@@ -640,8 +672,6 @@ static int usb_amradio_probe(struct usb_interface *intf,
 
 	radio->usbdev = interface_to_usbdev(intf);
 	radio->curfreq = 95.16 * FREQ_MUL;
-	radio->stereo = -1;
-	radio->muted = 1;
 
 	mutex_init(&radio->lock);
 
-- 
1.6.3.3

Reply via email to