From a760d63878b21fc16997b79e8ebee531b40c8b26 Mon Sep 17 00:00:00 2001 From: Malcolm Priestley Date: Fri, 22 Apr 2011 06:07:40 -0300 Subject: [PATCH] [media] lmedm04: don't write to buffer without a mutex usb_buffer not inside mutex lock, waiting caller can alter buffer. Static added to lme2510_exit and lme2510_exit_int. Signed-off-by: Malcolm Priestley Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-usb/lmedm04.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c index 7736384..4b457e7 100644 --- a/drivers/media/dvb/dvb-usb/lmedm04.c +++ b/drivers/media/dvb/dvb-usb/lmedm04.c @@ -169,14 +169,14 @@ static int lme2510_usb_talk(struct dvb_usb_device *d, } buff = st->usb_buffer; - /* the read/write capped at 512 */ - memcpy(buff, wbuf, (wlen > 512) ? 512 : wlen); - ret = mutex_lock_interruptible(&d->usb_mutex); if (ret < 0) return -EAGAIN; + /* the read/write capped at 512 */ + memcpy(buff, wbuf, (wlen > 512) ? 512 : wlen); + ret |= usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, 0x01)); ret |= lme2510_bulk_write(d->udev, buff, wlen , 0x01); @@ -1247,7 +1247,7 @@ static struct dvb_usb_device_properties lme2510c_properties = { } }; -void *lme2510_exit_int(struct dvb_usb_device *d) +static void *lme2510_exit_int(struct dvb_usb_device *d) { struct lme2510_state *st = d->priv; struct dvb_usb_adapter *adap = &d->adapter[0]; @@ -1274,7 +1274,7 @@ void *lme2510_exit_int(struct dvb_usb_device *d) return buffer; } -void lme2510_exit(struct usb_interface *intf) +static void lme2510_exit(struct usb_interface *intf) { struct dvb_usb_device *d = usb_get_intfdata(intf); void *usb_buffer; @@ -1316,5 +1316,5 @@ module_exit(lme2510_module_exit); MODULE_AUTHOR("Malcolm Priestley "); MODULE_DESCRIPTION("LME2510(C) DVB-S USB2.0"); -MODULE_VERSION("1.84"); +MODULE_VERSION("1.85"); MODULE_LICENSE("GPL"); -- 2.7.4