[media] iguanair: do not modify transmit buffer
Since commit "[media] rc-core: move timeout and checks to lirc", the
incoming buffer is used after the driver transmits.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 66ba237..1e4c68a 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -334,21 +334,34 @@
static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
{
struct iguanair *ir = dev->priv;
- uint8_t space, *payload;
- unsigned i, size, rc, bytes;
+ uint8_t space;
+ unsigned i, size, periods, bytes;
+ int rc;
struct send_packet *packet;
mutex_lock(&ir->lock);
+ packet = kmalloc(sizeof(*packet) + ir->bufsize, GFP_KERNEL);
+ if (!packet) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
/* convert from us to carrier periods */
- for (i = size = 0; i < count; i++) {
- txbuf[i] = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
- bytes = (txbuf[i] + 126) / 127;
+ for (i = space = size = 0; i < count; i++) {
+ periods = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
+ bytes = DIV_ROUND_UP(periods, 127);
if (size + bytes > ir->bufsize) {
count = i;
break;
}
- size += bytes;
+ while (periods > 127) {
+ packet->payload[size++] = 127 | space;
+ periods -= 127;
+ }
+
+ packet->payload[size++] = periods | space;
+ space ^= 0x80;
}
if (count == 0) {
@@ -356,12 +369,6 @@
goto out;
}
- packet = kmalloc(sizeof(*packet) + size, GFP_KERNEL);
- if (!packet) {
- rc = -ENOMEM;
- goto out;
- }
-
packet->header.start = 0;
packet->header.direction = DIR_OUT;
packet->header.cmd = CMD_SEND;
@@ -370,26 +377,11 @@
packet->busy7 = ir->busy7;
packet->busy4 = ir->busy4;
- space = 0;
- payload = packet->payload;
-
- for (i = 0; i < count; i++) {
- unsigned periods = txbuf[i];
-
- while (periods > 127) {
- *payload++ = 127 | space;
- periods -= 127;
- }
-
- *payload++ = periods | space;
- space ^= 0x80;
- }
-
if (ir->receiver_on) {
rc = iguanair_receiver(ir, false);
if (rc) {
dev_warn(ir->dev, "disable receiver before transmit failed\n");
- goto out_kfree;
+ goto out;
}
}
@@ -405,9 +397,8 @@
dev_warn(ir->dev, "re-enable receiver after transmit failed\n");
}
-out_kfree:
- kfree(packet);
out:
+ kfree(packet);
mutex_unlock(&ir->lock);
return rc ? rc : count;