1 files changed, 37 insertions, 32 deletions

diff --git a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
index b415141b2859..087a18245560 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
@@ -57,6 +57,9 @@ struct pvr2_v4l2_fh {
         struct pvr2_v4l2_fh *vprev;
         wait_queue_head_t wait_data;
         int fw_mode_flag;
+        /* Map contiguous ordinal value to input id */
+        unsigned char *input_map;
+        unsigned int input_cnt;
 };
 
 struct pvr2_v4l2 {
@@ -66,10 +69,6 @@ struct pvr2_v4l2 {
 
         struct v4l2_prio_state prio;
 
-        /* Map contiguous ordinal value to input id */
-        unsigned char *input_map;
-        unsigned int input_cnt;
-
         /* streams - Note that these must be separately, individually,
          * allocated pointers.  This is because the v4l core is going to
          * manage their deletion - separately, individually...  */
@@ -269,11 +268,11 @@ static int pvr2_v4l2_do_ioctl(struct inode *inode, struct file *file,
                 memset(&tmp,0,sizeof(tmp));
                 tmp.index = vi->index;
                 ret = 0;
-                if ((vi->index < 0) || (vi->index >= vp->input_cnt)) {
+                if ((vi->index < 0) || (vi->index >= fh->input_cnt)) {
                         ret = -EINVAL;
                         break;
                 }
-                val = vp->input_map[vi->index];
+                val = fh->input_map[vi->index];
                 switch (val) {
                 case PVR2_CVAL_INPUT_TV:
                 case PVR2_CVAL_INPUT_DTV:
@@ -321,8 +320,8 @@ static int pvr2_v4l2_do_ioctl(struct inode *inode, struct file *file,
                 val = 0;
                 ret = pvr2_ctrl_get_value(cptr,&val);
                 vi->index = 0;
-                for (idx = 0; idx < vp->input_cnt; idx++) {
-                        if (vp->input_map[idx] == val) {
+                for (idx = 0; idx < fh->input_cnt; idx++) {
+                        if (fh->input_map[idx] == val) {
                                 vi->index = idx;
                                 break;
                         }
@@ -333,13 +332,13 @@ static int pvr2_v4l2_do_ioctl(struct inode *inode, struct file *file,
         case VIDIOC_S_INPUT:
         {
                 struct v4l2_input *vi = (struct v4l2_input *)arg;
-                if ((vi->index < 0) || (vi->index >= vp->input_cnt)) {
+                if ((vi->index < 0) || (vi->index >= fh->input_cnt)) {
                         ret = -ERANGE;
                         break;
                 }
                 ret = pvr2_ctrl_set_value(
                         pvr2_hdw_get_ctrl_by_id(hdw,PVR2_CID_INPUT),
-                        vp->input_map[vi->index]);
+                        fh->input_map[vi->index]);
                 break;
         }
 
@@ -838,10 +837,6 @@ static void pvr2_v4l2_destroy_no_lock(struct pvr2_v4l2 *vp)
                 pvr2_v4l2_dev_destroy(vp->dev_radio);
                 vp->dev_radio = NULL;
         }
-        if (vp->input_map) {
-                kfree(vp->input_map);
-                vp->input_map = NULL;
-        }
 
         pvr2_trace(PVR2_TRACE_STRUCT,"Destroying pvr2_v4l2 id=%p",vp);
         pvr2_channel_done(&vp->channel);
@@ -915,6 +910,10 @@ static int pvr2_v4l2_release(struct inode *inode, struct file *file)
         pvr2_channel_done(&fhp->channel);
         pvr2_trace(PVR2_TRACE_STRUCT,
                    "Destroying pvr_v4l2_fh id=%p",fhp);
+        if (fhp->input_map) {
+                kfree(fhp->input_map);
+                fhp->input_map = NULL;
+        }
         kfree(fhp);
         if (vp->channel.mc_head->disconnect_flag && !vp->vfirst) {
                 pvr2_v4l2_destroy_no_lock(vp);
@@ -930,6 +929,7 @@ static int pvr2_v4l2_open(struct inode *inode, struct file *file)
         struct pvr2_v4l2 *vp;
         struct pvr2_hdw *hdw;
         unsigned int input_mask = 0;
+        unsigned int input_cnt,idx;
         int ret = 0;
 
         dip = container_of(video_devdata(file),struct pvr2_v4l2_dev,devbase);
@@ -979,6 +979,27 @@ static int pvr2_v4l2_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
+        input_mask &= pvr2_hdw_get_input_available(hdw);
+        input_cnt = 0;
+        for (idx = 0; idx < (sizeof(input_mask) << 3); idx++) {
+                if (input_mask & (1 << idx)) input_cnt++;
+        }
+        fhp->input_cnt = input_cnt;
+        fhp->input_map = kzalloc(input_cnt,GFP_KERNEL);
+        if (!fhp->input_map) {
+                pvr2_channel_done(&fhp->channel);
+                pvr2_trace(PVR2_TRACE_STRUCT,
+                           "Destroying pvr_v4l2_fh id=%p (input map failure)",
+                           fhp);
+                kfree(fhp);
+                return -ENOMEM;
+        }
+        input_cnt = 0;
+        for (idx = 0; idx < (sizeof(input_mask) << 3); idx++) {
+                if (!(input_mask & (1 << idx))) continue;
+                fhp->input_map[input_cnt++] = idx;
+        }
+
         fhp->vnext = NULL;
         fhp->vprev = vp->vlast;
         if (vp->vlast) {
@@ -1217,8 +1238,6 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
 struct pvr2_v4l2 *pvr2_v4l2_create(struct pvr2_context *mnp)
 {
         struct pvr2_v4l2 *vp;
-        struct pvr2_hdw *hdw;
-        unsigned int input_mask,input_cnt,idx;
 
         vp = kzalloc(sizeof(*vp),GFP_KERNEL);
         if (!vp) return vp;
@@ -1227,26 +1246,12 @@ struct pvr2_v4l2 *pvr2_v4l2_create(struct pvr2_context *mnp)
 
         vp->channel.check_func = pvr2_v4l2_internal_check;
 
-        hdw = vp->channel.mc_head->hdw;
-        input_mask = pvr2_hdw_get_input_available(hdw);
-        input_cnt = 0;
-        for (idx = 0; idx < (sizeof(input_mask) << 3); idx++) {
-                if (input_mask & (1 << idx)) input_cnt++;
-        }
-        vp->input_cnt = input_cnt;
-        vp->input_map = kzalloc(input_cnt,GFP_KERNEL);
-        if (!vp->input_map) goto fail;
-        input_cnt = 0;
-        for (idx = 0; idx < (sizeof(input_mask) << 3); idx++) {
-                if (!(input_mask & (1 << idx))) continue;
-                vp->input_map[input_cnt++] = idx;
-        }
-
         /* register streams */
         vp->dev_video = kzalloc(sizeof(*vp->dev_video),GFP_KERNEL);
         if (!vp->dev_video) goto fail;
         pvr2_v4l2_dev_init(vp->dev_video,vp,VFL_TYPE_GRABBER);
-        if (input_mask & (1 << PVR2_CVAL_INPUT_RADIO)) {
+        if (pvr2_hdw_get_input_available(vp->channel.mc_head->hdw) &
+            (1 << PVR2_CVAL_INPUT_RADIO)) {
                 vp->dev_radio = kzalloc(sizeof(*vp->dev_radio),GFP_KERNEL);
                 if (!vp->dev_radio) goto fail;
                 pvr2_v4l2_dev_init(vp->dev_radio,vp,VFL_TYPE_RADIO);