V4L/DVB (8195): gspca: Input buffer overwritten in spca561 + cleanup code.

spca561:  Input buffer may be changed on reg write.
(all sd): Cleanup code, 'const' added.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 52 insertions, 46 deletions

diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 473bea750b5..6d50247b7ad 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -25,8 +25,8 @@
 #define CONEX_CAM 1		/* special JPEG header */
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 3)
-static const char version[] = "2.1.3";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 4)
+static const char version[] = "2.1.4";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA USB Conexant Camera Driver");
@@ -229,7 +229,7 @@ static void cx11646_fw(struct gspca_dev*gspca_dev)
 	reg_w(gspca_dev->dev, 0x006a, &val, 1);
 }
 
-static __u8 cxsensor[] = {
+static const __u8 cxsensor[] = {
 	0x88, 0x12, 0x70, 0x01,
 	0x88, 0x0d, 0x02, 0x01,
 	0x88, 0x0f, 0x00, 0x01,
@@ -244,24 +244,24 @@ static __u8 cxsensor[] = {
 	0x00
 };
 
-static __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };
-static __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };
-static __u8 reg10[] = { 0xb1, 0xb1 };
-static __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };	/* 640 */
-static __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };
+static const __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };
+static const __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };
+static const __u8 reg10[] = { 0xb1, 0xb1 };
+static const __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };	/* 640 */
+static const __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };
 	/* 352{0x04,0x0a,0x06,0x12}; //352{0x05,0x0e,0x06,0x11}; //352 */
-static __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };
+static const __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };
 					/* 320{0x04,0x0c,0x05,0x0f}; //320 */
-static __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };	/* 176 */
-static __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };
+static const __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };	/* 176 */
+static const __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };
 
 static void cx_sensor(struct gspca_dev*gspca_dev)
 {
-	__u8 val = 0;
+	__u8 val;
 	int i = 0;
 	__u8 bufread[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-	int length = 0;
-	__u8 *ptsensor = cxsensor;
+	int length;
+	const __u8 *ptsensor = cxsensor;
 
 	reg_w(gspca_dev->dev, 0x0020, reg20, 8);
 	reg_w(gspca_dev->dev, 0x0028, reg28, 8);
@@ -305,7 +305,7 @@ static void cx_sensor(struct gspca_dev*gspca_dev)
 	reg_r(gspca_dev->dev, 0x00e7, bufread, 8);
 }
 
-static __u8 cx_inits_176[] = {
+static const __u8 cx_inits_176[] = {
 	0x33, 0x81, 0xB0, 0x00, 0x90, 0x00, 0x0A, 0x03,	/* 176x144 */
 	0x00, 0x03, 0x03, 0x03, 0x1B, 0x05, 0x30, 0x03,
 	0x65, 0x15, 0x18, 0x25, 0x03, 0x25, 0x08, 0x30,
@@ -314,7 +314,7 @@ static __u8 cx_inits_176[] = {
 	0xF7, 0xFF, 0x88, 0xFF, 0x66, 0x02, 0x28, 0x02,
 	0x1E, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_320[] = {
+static const __u8 cx_inits_320[] = {
 	0x7f, 0x7f, 0x40, 0x01, 0xf0, 0x00, 0x02, 0x01,
 	0x00, 0x01, 0x01, 0x01, 0x10, 0x00, 0x02, 0x01,
 	0x65, 0x45, 0xfa, 0x4c, 0x2c, 0xdf, 0xb9, 0x81,
@@ -323,7 +323,7 @@ static __u8 cx_inits_320[] = {
 	0xf5, 0xff, 0x6d, 0xff, 0xf6, 0x01, 0x43, 0x02,
 	0xd3, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_352[] = {
+static const __u8 cx_inits_352[] = {
 	0x2e, 0x7c, 0x60, 0x01, 0x20, 0x01, 0x05, 0x03,
 	0x00, 0x06, 0x03, 0x06, 0x1b, 0x10, 0x05, 0x3b,
 	0x30, 0x25, 0x18, 0x25, 0x08, 0x30, 0x03, 0x25,
@@ -332,7 +332,7 @@ static __u8 cx_inits_352[] = {
 	0xf5, 0xff, 0x6b, 0xff, 0xee, 0x01, 0x43, 0x02,
 	0xe4, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_640[] = {
+static const __u8 cx_inits_640[] = {
 	0x7e, 0x7e, 0x80, 0x02, 0xe0, 0x01, 0x01, 0x01,
 	0x00, 0x02, 0x01, 0x02, 0x10, 0x30, 0x01, 0x01,
 	0x65, 0x45, 0xf7, 0x52, 0x2c, 0xdf, 0xb9, 0x81,
@@ -344,7 +344,7 @@ static __u8 cx_inits_640[] = {
 
 static int cx11646_initsize(struct gspca_dev *gspca_dev)
 {
-	__u8 *cxinit;
+	const __u8 *cxinit;
 	__u8 val;
 	static const __u8 reg12[] = { 0x08, 0x05, 0x07, 0x04, 0x24 };
 	static const __u8 reg17[] =
@@ -396,7 +396,7 @@ static int cx11646_initsize(struct gspca_dev *gspca_dev)
 	return val;
 }
 
-static __u8 cx_jpeg_init[][8] = {
+static const __u8 cx_jpeg_init[][8] = {
 	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x15},	/* 1 */
 	{0x0f, 0x10, 0x12, 0x10, 0x0d, 0x15, 0x12, 0x11},
 	{0x12, 0x18, 0x16, 0x15, 0x19, 0x20, 0x35, 0x22},
@@ -479,7 +479,7 @@ static __u8 cx_jpeg_init[][8] = {
 };
 
 
-static __u8 cxjpeg_640[][8] = {
+static const __u8 cxjpeg_640[][8] = {
 	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x10},	/* 1 */
 	{0x0b, 0x0c, 0x0e, 0x0c, 0x0a, 0x10, 0x0e, 0x0d},
 	{0x0e, 0x12, 0x11, 0x10, 0x13, 0x18, 0x28, 0x1a},
@@ -508,7 +508,7 @@ static __u8 cxjpeg_640[][8] = {
 	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
 	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}	/* 27 */
 };
-static __u8 cxjpeg_352[][8] = {
+static const __u8 cxjpeg_352[][8] = {
 	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},
 	{0x09, 0x09, 0x0b, 0x09, 0x08, 0x0D, 0x0b, 0x0a},
 	{0x0b, 0x0e, 0x0d, 0x0d, 0x0f, 0x13, 0x1f, 0x14},
@@ -537,7 +537,7 @@ static __u8 cxjpeg_352[][8] = {
 	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
 	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
 };
-static __u8 cxjpeg_320[][8] = {
+static const __u8 cxjpeg_320[][8] = {
 	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x05},
 	{0x03, 0x04, 0x04, 0x04, 0x03, 0x05, 0x04, 0x04},
 	{0x04, 0x05, 0x05, 0x05, 0x06, 0x07, 0x0c, 0x08},
@@ -566,7 +566,7 @@ static __u8 cxjpeg_320[][8] = {
 	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
 	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}	/* 27 */
 };
-static __u8 cxjpeg_176[][8] = {
+static const __u8 cxjpeg_176[][8] = {
 	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},
 	{0x09, 0x09, 0x0B, 0x09, 0x08, 0x0D, 0x0B, 0x0A},
 	{0x0B, 0x0E, 0x0D, 0x0D, 0x0F, 0x13, 0x1F, 0x14},
@@ -595,7 +595,8 @@ static __u8 cxjpeg_176[][8] = {
 	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
 	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
 };
-static __u8 cxjpeg_qtable[][8] = {	/* 640 take with the zcx30x part */
+/* 640 take with the zcx30x part */
+static const __u8 cxjpeg_qtable[][8] = {
 	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x08},
 	{0x06, 0x06, 0x07, 0x06, 0x05, 0x08, 0x07, 0x07},
 	{0x07, 0x09, 0x09, 0x08, 0x0a, 0x0c, 0x14, 0x0a},
@@ -641,22 +642,23 @@ static void cx11646_jpegInit(struct gspca_dev*gspca_dev)
 	reg_w(gspca_dev->dev, 0x0055, &val, 1);
 }
 
-static __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };
-static __u8 regE5_8[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
-static __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };
-static __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };
-static __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };
-static __u8 reg51[] = { 0x77, 0x03 };
-static __u8 reg70 = 0x03;
+static const __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };
+static const __u8 regE5_8[] =
+		{ 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
+static const __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };
+static const __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };
+static const __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };
+static const __u8 reg51[] = { 0x77, 0x03 };
+static const __u8 reg70 = 0x03;
 
 static void cx11646_jpeg(struct gspca_dev*gspca_dev)
 {
 	__u8 val;
 	int i;
-	int length = 8;
-	__u8 Reg55 = 0x14;
-	__u8 bufread[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-	int retry = 50;
+	int length;
+	__u8 Reg55;
+	__u8 bufread[8];
+	int retry;
 
 	val = 0x01;
 	reg_w(gspca_dev->dev, 0x00c0, &val, 1);
@@ -665,6 +667,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev)
 	val = 0x00;
 	reg_w(gspca_dev->dev, 0x00c0, &val, 1);
 	reg_r(gspca_dev->dev, 0x0001, &val, 1);
+	length = 8;
 	switch (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].mode) {
 	case 0:
 		for (i = 0; i < 27; i++) {
@@ -719,6 +722,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev)
 	val = 0x00;
 	reg_w(gspca_dev->dev, 0x0000, &val, 1);
 	/* wait for completion */
+	retry = 50;
 	while (retry--) {
 		reg_r(gspca_dev->dev, 0x0002, &val, 1);
 							/* 0x07 until 0x00 */
@@ -796,8 +800,8 @@ static void cx11646_init1(struct gspca_dev *gspca_dev)
 	reg_w(gspca_dev->dev, 0x003f, &val, 1);
 	val = 0x40;
 	reg_w(gspca_dev->dev, 0x003d, &val, 1);
-/* val= 0x60; */
-/* reg_w(gspca_dev->dev,0x00,0x00,0x003d,&val,1); */
+/*	val= 0x60; */
+/*	reg_w(gspca_dev->dev, 0x00, 0x00, 0x003d, &val, 1); */
 	reg_r(gspca_dev->dev, 0x0099, &val, 1);			/* ->0x07 */
 
 	while (cx_sensor_init[i][0]) {
@@ -827,7 +831,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	cam->cam_mode = vga_mode;
 	cam->nmodes = sizeof vga_mode / sizeof vga_mode[0];
 
-	sd->qindex = 0;			/* set the quantization table */
+	sd->qindex = 0;			/* set the quantization */
 	sd->brightness = sd_ctrls[SD_BRIGHTNESS].qctrl.default_value;
 	sd->contrast = sd_ctrls[SD_CONTRAST].qctrl.default_value;
 	sd->colors = sd_ctrls[SD_COLOR].qctrl.default_value;
@@ -891,7 +895,7 @@ static void sd_close(struct gspca_dev *gspca_dev)
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			struct gspca_frame *frame,	/* target */
-			unsigned char *data,		/* isoc packet */
+			__u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	if (data[0] == 0xff && data[1] == 0xd8) {
@@ -914,21 +918,22 @@ static void setbrightness(struct gspca_dev*gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	__u8 regE5cbx[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
-	__u8 reg51c[] = { 0x77, 0x03 };
+	__u8 reg51c[2];
 	__u8 bright;
 	__u8 colors;
 	__u8 val;
 	__u8 bufread[8];
 
 	bright = sd->brightness;
-	colors = sd->colors;
 	regE5cbx[2] = bright;
-	reg51c[1] = colors;
 	reg_w(gspca_dev->dev, 0x00e5, regE5cbx, 8);
 	reg_r(gspca_dev->dev, 0x00e8, bufread, 8);
 	reg_w(gspca_dev->dev, 0x00e5, regE5c, 4);
 	reg_r(gspca_dev->dev, 0x00e8, &val, 1);	/* 0x00 */
 
+	colors = sd->colors;
+	reg51c[0] = 0x77;
+	reg51c[1] = colors;
 	reg_w(gspca_dev->dev, 0x0051, reg51c, 2);
 	reg_w(gspca_dev->dev, 0x0010, reg10, 2);
 	reg_w(gspca_dev->dev, 0x0070, &reg70, 1);
@@ -938,14 +943,15 @@ static void setcontrast(struct gspca_dev*gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	__u8 regE5acx[] = { 0x88, 0x0a, 0x0c, 0x01 };	/* seem MSB */
-	/* __u8 regE5bcx[]={0x88,0x0b,0x12,0x01}; // LSB */
-	__u8 reg51c[] = { 0x77, 0x03 };
+/*	__u8 regE5bcx[] = { 0x88, 0x0b, 0x12, 0x01};	 * LSB */
+	__u8 reg51c[2];
 	__u8 val;
 
-	reg51c[1] = sd->colors;
 	regE5acx[2] = sd->contrast;
 	reg_w(gspca_dev->dev, 0x00e5, regE5acx, 4);
 	reg_r(gspca_dev->dev, 0x00e8, &val, 1);	/* 0x00 */
+	reg51c[0] = 0x77;
+	reg51c[1] = sd->colors;
 	reg_w(gspca_dev->dev, 0x0051, reg51c, 2);
 	reg_w(gspca_dev->dev, 0x0010, reg10, 2);
 	reg_w(gspca_dev->dev, 0x0070, &reg70, 1);