V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble

[linux-2.6-omap-h63xx.git] / drivers / media / video / tvaudio.c

diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index 55b39b9a33d9596fc6af21b598a23906a8e8c528..3720f0e03a16906efd339b0eefb89b5454499abf 100644 (file)
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -34,6 +34,7 @@
 
 #include <media/tvaudio.h>
 #include <media/v4l2-common.h>
+#include <media/v4l2-ioctl.h>
 #include <media/v4l2-chip-ident.h>
 #include <media/v4l2-i2c-drv-legacy.h>
 
@@ -106,7 +107,6 @@ struct CHIPDESC {
        int  inputmute;
        int  inputmask;
 };
-static struct CHIPDESC chiplist[];
 
 /* current state of the chip */
 struct CHIPSTATE {
@@ -1639,13 +1639,13 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                return 0;
        }
        case V4L2_CID_AUDIO_BASS:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                        break;
                ctrl->value = chip->bass;
                return 0;
        case V4L2_CID_AUDIO_TREBLE:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
-                       return -EINVAL;
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                       break;
                ctrl->value = chip->treble;
                return 0;
        }
@@ -1705,16 +1705,15 @@ static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                return 0;
        }
        case V4L2_CID_AUDIO_BASS:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                        break;
                chip->bass = ctrl->value;
                chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
 
                return 0;
        case V4L2_CID_AUDIO_TREBLE:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
-                       return -EINVAL;
-
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                       break;
                chip->treble = ctrl->value;
                chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
 
@@ -1733,7 +1732,10 @@ static int chip_command(struct i2c_client *client,
        struct CHIPSTATE *chip = i2c_get_clientdata(client);
        struct CHIPDESC  *desc = chip->desc;
 
-       v4l_dbg(1, debug, chip->c, "%s: chip_command 0x%x\n", chip->c->name, cmd);
+       if (debug > 0) {
+               v4l_i2c_print_ioctl(chip->c, cmd);
+               printk("\n");
+       }
 
        switch (cmd) {
        case AUDC_SET_RADIO:
@@ -1758,7 +1760,7 @@ static int chip_command(struct i2c_client *client,
                                break;
                        case V4L2_CID_AUDIO_BASS:
                        case V4L2_CID_AUDIO_TREBLE:
-                               if (desc->flags & CHIP_HAS_BASSTREBLE)
+                               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                                        return -EINVAL;
                                break;
                        default:
@@ -1856,11 +1858,13 @@ static int chip_command(struct i2c_client *client,
        case VIDIOC_S_FREQUENCY:
                chip->mode = 0; /* automatic */
 
-               /* For chips that provide getmode, setmode and checkmode,
-                  a kthread is created to automatically to set the audio
-                  standard. In this case, start with MONO and wait 2 seconds
-                  for the decoding to stablize. Then, run kthread to change
-                  to stereo, if carrier detected.
+               /* For chips that provide getmode and setmode, and doesn't
+                  automatically follows the stereo carrier, a kthread is
+                  created to set the audio standard. In this case, when then
+                  the video channel is changed, tvaudio starts on MONO mode.
+                  After waiting for 2 seconds, the kernel thread is called,
+                  to follow whatever audio standard is pointed by the
+                  audio carrier.
                 */
                if (chip->thread) {
                        desc->setmode(chip,V4L2_TUNER_MODE_MONO);
@@ -1905,9 +1909,3 @@ static struct v4l2_i2c_driver_data v4l2_i2c_data = {
        .legacy_probe = chip_legacy_probe,
        .id_table = chip_id,
 };
-
-/*
- * Local variables:
- * c-basic-offset: 8
- * End:
- */