From 8c441616f67011244cb15bc1a3dda6fd8706ecd2 Mon Sep 17 00:00:00 2001
From: David Ellingsworth <david@xxxxxxxxxxxxxxxxx>
Date: Sat, 12 Sep 2009 16:04:44 -0400
Subject: [PATCH 08/14] mr800: fix potential use after free
Signed-off-by: David Ellingsworth <david@xxxxxxxxxxxxxxxxx>
---
drivers/media/radio/radio-mr800.c | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/drivers/media/radio/radio-mr800.c
b/drivers/media/radio/radio-mr800.c
index 9fd2342..87b58e3 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -274,7 +274,6 @@ static void usb_amradio_disconnect(struct
usb_interface *intf)
usb_set_intfdata(intf, NULL);
video_unregister_device(&radio->videodev);
- v4l2_device_disconnect(&radio->v4l2_dev);
}
/* vidioc_querycap - query device capabilities */
--
1.6.3.3
>From 1c62f52da6114756d16644f8401f1903a50ae455 Mon Sep 17 00:00:00 2001
From: David Ellingsworth <david@xxxxxxxxxxxxxxxxx>
Date: Sat, 12 Sep 2009 22:03:56 -0400
Subject: [PATCH 14/14] mr800: set radio frequency only upon success
Signed-off-by: David Ellingsworth <david@xxxxxxxxxxxxxxxxx>
---
drivers/media/radio/radio-mr800.c | 8 ++------
1 files changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 4d955aa..f609fdf 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -235,6 +235,7 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
if (retval < 0 || size != BUFFER_LENGTH)
goto out_err;
+ radio->curfreq = freq;
goto out;
out_err:
@@ -370,13 +371,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
struct v4l2_frequency *f)
{
struct amradio_device *radio = file->private_data;
- int retval = 0;
-
- radio->curfreq = f->frequency;
- retval = amradio_setfreq(radio, radio->curfreq);
-
- return retval;
+ return amradio_setfreq(radio, f->frequency);
}
/* vidioc_g_frequency - get tuner radio frequency */
--
1.6.3.3
