V4L/DVB (8842): vivi_release(): fix use-after-free

[safe/jmp/linux-2.6] / drivers / media / video / saa7110.c

diff --git a/drivers/media/video/saa7110.c b/drivers/media/video/saa7110.c
index 20cad9f..4aa82b3 100644 (file)
--- a/drivers/media/video/saa7110.c
+++ b/drivers/media/video/saa7110.c
@@ -39,14 +39,14 @@ MODULE_AUTHOR("Pauline Middelink");
 MODULE_LICENSE("GPL");
 
 #include <linux/i2c.h>
-#include <linux/i2c-dev.h>
 
 #define I2C_NAME(s) (s)->name
 
 #include <linux/videodev.h>
+#include <media/v4l2-common.h>
 #include <linux/video_decoder.h>
 
-static int debug = 0;
+static int debug;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0-1)");
 
@@ -108,13 +108,8 @@ saa7110_write_block (struct i2c_client *client,
         * the adapter understands raw I2C */
        if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
                struct saa7110 *decoder = i2c_get_clientdata(client);
-               struct i2c_msg msg;
 
-               msg.len = len;
-               msg.buf = (char *) data;
-               msg.addr = client->addr;
-               msg.flags = 0;
-               ret = i2c_transfer(client->adapter, &msg, 1);
+               ret = i2c_master_send(client, data, len);
 
                /* Cache the written data */
                memcpy(decoder->reg + reg, data + 1, len - 1);
@@ -145,7 +140,7 @@ saa7110_read (struct i2c_client *client)
 
 static int
 saa7110_selmux (struct i2c_client *client,
-               int                chan)
+               int                chan)
 {
        static const unsigned char modes[9][8] = {
                /* mode 0 */
@@ -213,7 +208,7 @@ determine_norm (struct i2c_client *client)
        saa7110_write_block(client, initseq, sizeof(initseq));
        saa7110_selmux(client, decoder->input);
        prepare_to_wait(&decoder->wq, &wait, TASK_UNINTERRUPTIBLE);
-       schedule_timeout(HZ/4);
+       schedule_timeout(msecs_to_jiffies(250));
        finish_wait(&decoder->wq, &wait);
        status = saa7110_read(client);
        if (status & 0x40) {
@@ -254,7 +249,7 @@ determine_norm (struct i2c_client *client)
        //saa7110_write(client,0x2E,0x9A);
 
        prepare_to_wait(&decoder->wq, &wait, TASK_UNINTERRUPTIBLE);
-       schedule_timeout(HZ/4);
+       schedule_timeout(msecs_to_jiffies(250));
        finish_wait(&decoder->wq, &wait);
 
        status = saa7110_read(client);
@@ -463,7 +458,7 @@ static unsigned short normal_i2c[] = {
 };
 
 static unsigned short ignore = I2C_CLIENT_END;
-                                                                                
+
 static struct i2c_client_address_data addr_data = {
        .normal_i2c             = normal_i2c,
        .probe                  = &ignore,
@@ -493,7 +488,7 @@ saa7110_detect_client (struct i2c_adapter *adapter,
                return 0;
 
        client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
-       if (client == 0)
+       if (!client)
                return -ENOMEM;
        client->addr = address;
        client->adapter = adapter;
@@ -501,7 +496,7 @@ saa7110_detect_client (struct i2c_adapter *adapter,
        strlcpy(I2C_NAME(client), "saa7110", sizeof(I2C_NAME(client)));
 
        decoder = kzalloc(sizeof(struct saa7110), GFP_KERNEL);
-       if (decoder == 0) {
+       if (!decoder) {
                kfree(client);
                return -ENOMEM;
        }