[media] iguanair: do not modify transmit buffer

Since commit "[media] rc-core: move timeout and checks to lirc", the
incoming buffer is used after the driver transmits.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 21 insertions, 30 deletions

diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 66ba23738601..1e4c68a5cecf 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -334,21 +334,34 @@ static int iguanair_set_tx_mask(struct rc_dev *dev, uint32_t mask)
 static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 {
         struct iguanair *ir = dev->priv;
-        uint8_t space, *payload;
-        unsigned i, size, rc, bytes;
+        uint8_t space;
+        unsigned i, size, periods, bytes;
+        int rc;
         struct send_packet *packet;
 
         mutex_lock(&ir->lock);
 
+        packet = kmalloc(sizeof(*packet) + ir->bufsize, GFP_KERNEL);
+        if (!packet) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
         /* convert from us to carrier periods */
-        for (i = size = 0; i < count; i++) {
-                txbuf[i] = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
-                bytes = (txbuf[i] + 126) / 127;
+        for (i = space = size = 0; i < count; i++) {
+                periods = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
+                bytes = DIV_ROUND_UP(periods, 127);
                 if (size + bytes > ir->bufsize) {
                         count = i;
                         break;
                 }
-                size += bytes;
+                while (periods > 127) {
+                        packet->payload[size++] = 127 | space;
+                        periods -= 127;
+                }
+
+                packet->payload[size++] = periods | space;
+                space ^= 0x80;
         }
 
         if (count == 0) {
@@ -356,12 +369,6 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
                 goto out;
         }
 
-        packet = kmalloc(sizeof(*packet) + size, GFP_KERNEL);
-        if (!packet) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
         packet->header.start = 0;
         packet->header.direction = DIR_OUT;
         packet->header.cmd = CMD_SEND;
@@ -370,26 +377,11 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
         packet->busy7 = ir->busy7;
         packet->busy4 = ir->busy4;
 
-        space = 0;
-        payload = packet->payload;
-
-        for (i = 0; i < count; i++) {
-                unsigned periods = txbuf[i];
-
-                while (periods > 127) {
-                        *payload++ = 127 | space;
-                        periods -= 127;
-                }
-
-                *payload++ = periods | space;
-                space ^= 0x80;
-        }
-
         if (ir->receiver_on) {
                 rc = iguanair_receiver(ir, false);
                 if (rc) {
                         dev_warn(ir->dev, "disable receiver before transmit failed\n");
-                        goto out_kfree;
+                        goto out;
                 }
         }
 
@@ -405,9 +397,8 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
                         dev_warn(ir->dev, "re-enable receiver after transmit failed\n");
         }
 
-out_kfree:
-        kfree(packet);
 out:
+        kfree(packet);
         mutex_unlock(&ir->lock);
 
         return rc ? rc : count;