V4L/DVB (8195): gspca: Input buffer overwritten in spca561 + cleanup code.

spca561:  Input buffer may be changed on reg write.
(all sd): Cleanup code, 'const' added.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 52 insertions, 46 deletions

diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 473bea750b5f..6d50247b7ad2 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -25,8 +25,8 @@
 #define CONEX_CAM 1             /* special JPEG header */
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 1, 3)
-static const char version[] = "2.1.3";
+#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 1, 4)
+static const char version[] = "2.1.4";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA USB Conexant Camera Driver");
@@ -229,7 +229,7 @@ static void cx11646_fw(struct gspca_dev*gspca_dev)
         reg_w(gspca_dev->dev, 0x006a, &val, 1);
 }
 
-static __u8 cxsensor[] = {
+static const __u8 cxsensor[] = {
         0x88, 0x12, 0x70, 0x01,
         0x88, 0x0d, 0x02, 0x01,
         0x88, 0x0f, 0x00, 0x01,
@@ -244,24 +244,24 @@ static __u8 cxsensor[] = {
         0x00
 };
 
-static __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };
-static __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };
-static __u8 reg10[] = { 0xb1, 0xb1 };
-static __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };      /* 640 */
-static __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };
+static const __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };
+static const __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };
+static const __u8 reg10[] = { 0xb1, 0xb1 };
+static const __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };        /* 640 */
+static const __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };
         /* 352{0x04,0x0a,0x06,0x12}; //352{0x05,0x0e,0x06,0x11}; //352 */
-static __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };
+static const __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };
                                         /* 320{0x04,0x0c,0x05,0x0f}; //320 */
-static __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };      /* 176 */
-static __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };
+static const __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };        /* 176 */
+static const __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };
 
 static void cx_sensor(struct gspca_dev*gspca_dev)
 {
-        __u8 val = 0;
+        __u8 val;
         int i = 0;
         __u8 bufread[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-        int length = 0;
-        __u8 *ptsensor = cxsensor;
+        int length;
+        const __u8 *ptsensor = cxsensor;
 
         reg_w(gspca_dev->dev, 0x0020, reg20, 8);
         reg_w(gspca_dev->dev, 0x0028, reg28, 8);
@@ -305,7 +305,7 @@ static void cx_sensor(struct gspca_dev*gspca_dev)
         reg_r(gspca_dev->dev, 0x00e7, bufread, 8);
 }
 
-static __u8 cx_inits_176[] = {
+static const __u8 cx_inits_176[] = {
         0x33, 0x81, 0xB0, 0x00, 0x90, 0x00, 0x0A, 0x03, /* 176x144 */
         0x00, 0x03, 0x03, 0x03, 0x1B, 0x05, 0x30, 0x03,
         0x65, 0x15, 0x18, 0x25, 0x03, 0x25, 0x08, 0x30,
@@ -314,7 +314,7 @@ static __u8 cx_inits_176[] = {
         0xF7, 0xFF, 0x88, 0xFF, 0x66, 0x02, 0x28, 0x02,
         0x1E, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_320[] = {
+static const __u8 cx_inits_320[] = {
         0x7f, 0x7f, 0x40, 0x01, 0xf0, 0x00, 0x02, 0x01,
         0x00, 0x01, 0x01, 0x01, 0x10, 0x00, 0x02, 0x01,
         0x65, 0x45, 0xfa, 0x4c, 0x2c, 0xdf, 0xb9, 0x81,
@@ -323,7 +323,7 @@ static __u8 cx_inits_320[] = {
         0xf5, 0xff, 0x6d, 0xff, 0xf6, 0x01, 0x43, 0x02,
         0xd3, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_352[] = {
+static const __u8 cx_inits_352[] = {
         0x2e, 0x7c, 0x60, 0x01, 0x20, 0x01, 0x05, 0x03,
         0x00, 0x06, 0x03, 0x06, 0x1b, 0x10, 0x05, 0x3b,
         0x30, 0x25, 0x18, 0x25, 0x08, 0x30, 0x03, 0x25,
@@ -332,7 +332,7 @@ static __u8 cx_inits_352[] = {
         0xf5, 0xff, 0x6b, 0xff, 0xee, 0x01, 0x43, 0x02,
         0xe4, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_640[] = {
+static const __u8 cx_inits_640[] = {
         0x7e, 0x7e, 0x80, 0x02, 0xe0, 0x01, 0x01, 0x01,
         0x00, 0x02, 0x01, 0x02, 0x10, 0x30, 0x01, 0x01,
         0x65, 0x45, 0xf7, 0x52, 0x2c, 0xdf, 0xb9, 0x81,
@@ -344,7 +344,7 @@ static __u8 cx_inits_640[] = {
 
 static int cx11646_initsize(struct gspca_dev *gspca_dev)
 {
-        __u8 *cxinit;
+        const __u8 *cxinit;
         __u8 val;
         static const __u8 reg12[] = { 0x08, 0x05, 0x07, 0x04, 0x24 };
         static const __u8 reg17[] =
@@ -396,7 +396,7 @@ static int cx11646_initsize(struct gspca_dev *gspca_dev)
         return val;
 }
 
-static __u8 cx_jpeg_init[][8] = {
+static const __u8 cx_jpeg_init[][8] = {
         {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x15},       /* 1 */
         {0x0f, 0x10, 0x12, 0x10, 0x0d, 0x15, 0x12, 0x11},
         {0x12, 0x18, 0x16, 0x15, 0x19, 0x20, 0x35, 0x22},
@@ -479,7 +479,7 @@ static __u8 cx_jpeg_init[][8] = {
 };
 
 
-static __u8 cxjpeg_640[][8] = {
+static const __u8 cxjpeg_640[][8] = {
         {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x10},       /* 1 */
         {0x0b, 0x0c, 0x0e, 0x0c, 0x0a, 0x10, 0x0e, 0x0d},
         {0x0e, 0x12, 0x11, 0x10, 0x13, 0x18, 0x28, 0x1a},
@@ -508,7 +508,7 @@ static __u8 cxjpeg_640[][8] = {
         {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
         {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}        /* 27 */
 };
-static __u8 cxjpeg_352[][8] = {
+static const __u8 cxjpeg_352[][8] = {
         {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},
         {0x09, 0x09, 0x0b, 0x09, 0x08, 0x0D, 0x0b, 0x0a},
         {0x0b, 0x0e, 0x0d, 0x0d, 0x0f, 0x13, 0x1f, 0x14},
@@ -537,7 +537,7 @@ static __u8 cxjpeg_352[][8] = {
         {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
         {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
 };
-static __u8 cxjpeg_320[][8] = {
+static const __u8 cxjpeg_320[][8] = {
         {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x05},
         {0x03, 0x04, 0x04, 0x04, 0x03, 0x05, 0x04, 0x04},
         {0x04, 0x05, 0x05, 0x05, 0x06, 0x07, 0x0c, 0x08},
@@ -566,7 +566,7 @@ static __u8 cxjpeg_320[][8] = {
         {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
         {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}        /* 27 */
 };
-static __u8 cxjpeg_176[][8] = {
+static const __u8 cxjpeg_176[][8] = {
         {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},
         {0x09, 0x09, 0x0B, 0x09, 0x08, 0x0D, 0x0B, 0x0A},
         {0x0B, 0x0E, 0x0D, 0x0D, 0x0F, 0x13, 0x1F, 0x14},
@@ -595,7 +595,8 @@ static __u8 cxjpeg_176[][8] = {
         {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
         {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
 };
-static __u8 cxjpeg_qtable[][8] = {      /* 640 take with the zcx30x part */
+/* 640 take with the zcx30x part */
+static const __u8 cxjpeg_qtable[][8] = {
         {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x08},
         {0x06, 0x06, 0x07, 0x06, 0x05, 0x08, 0x07, 0x07},
         {0x07, 0x09, 0x09, 0x08, 0x0a, 0x0c, 0x14, 0x0a},
@@ -641,22 +642,23 @@ static void cx11646_jpegInit(struct gspca_dev*gspca_dev)
         reg_w(gspca_dev->dev, 0x0055, &val, 1);
 }
 
-static __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };
-static __u8 regE5_8[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
-static __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };
-static __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };
-static __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };
-static __u8 reg51[] = { 0x77, 0x03 };
-static __u8 reg70 = 0x03;
+static const __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };
+static const __u8 regE5_8[] =
+                { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
+static const __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };
+static const __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };
+static const __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };
+static const __u8 reg51[] = { 0x77, 0x03 };
+static const __u8 reg70 = 0x03;
 
 static void cx11646_jpeg(struct gspca_dev*gspca_dev)
 {
         __u8 val;
         int i;
-        int length = 8;
-        __u8 Reg55 = 0x14;
-        __u8 bufread[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-        int retry = 50;
+        int length;
+        __u8 Reg55;
+        __u8 bufread[8];
+        int retry;
 
         val = 0x01;
         reg_w(gspca_dev->dev, 0x00c0, &val, 1);
@@ -665,6 +667,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev)
         val = 0x00;
         reg_w(gspca_dev->dev, 0x00c0, &val, 1);
         reg_r(gspca_dev->dev, 0x0001, &val, 1);
+        length = 8;
         switch (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].mode) {
         case 0:
                 for (i = 0; i < 27; i++) {
@@ -719,6 +722,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev)
         val = 0x00;
         reg_w(gspca_dev->dev, 0x0000, &val, 1);
         /* wait for completion */
+        retry = 50;
         while (retry--) {
                 reg_r(gspca_dev->dev, 0x0002, &val, 1);
                                                         /* 0x07 until 0x00 */
@@ -796,8 +800,8 @@ static void cx11646_init1(struct gspca_dev *gspca_dev)
         reg_w(gspca_dev->dev, 0x003f, &val, 1);
         val = 0x40;
         reg_w(gspca_dev->dev, 0x003d, &val, 1);
-/* val= 0x60; */
-/* reg_w(gspca_dev->dev,0x00,0x00,0x003d,&val,1); */
+/*      val= 0x60; */
+/*      reg_w(gspca_dev->dev, 0x00, 0x00, 0x003d, &val, 1); */
         reg_r(gspca_dev->dev, 0x0099, &val, 1);                 /* ->0x07 */
 
         while (cx_sensor_init[i][0]) {
@@ -827,7 +831,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
         cam->cam_mode = vga_mode;
         cam->nmodes = sizeof vga_mode / sizeof vga_mode[0];
 
-        sd->qindex = 0;                 /* set the quantization table */
+        sd->qindex = 0;                 /* set the quantization */
         sd->brightness = sd_ctrls[SD_BRIGHTNESS].qctrl.default_value;
         sd->contrast = sd_ctrls[SD_CONTRAST].qctrl.default_value;
         sd->colors = sd_ctrls[SD_COLOR].qctrl.default_value;
@@ -891,7 +895,7 @@ static void sd_close(struct gspca_dev *gspca_dev)
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                         struct gspca_frame *frame,      /* target */
-                        unsigned char *data,            /* isoc packet */
+                        __u8 *data,                     /* isoc packet */
                         int len)                        /* iso packet length */
 {
         if (data[0] == 0xff && data[1] == 0xd8) {
@@ -914,21 +918,22 @@ static void setbrightness(struct gspca_dev*gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
         __u8 regE5cbx[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
-        __u8 reg51c[] = { 0x77, 0x03 };
+        __u8 reg51c[2];
         __u8 bright;
         __u8 colors;
         __u8 val;
         __u8 bufread[8];
 
         bright = sd->brightness;
-        colors = sd->colors;
         regE5cbx[2] = bright;
-        reg51c[1] = colors;
         reg_w(gspca_dev->dev, 0x00e5, regE5cbx, 8);
         reg_r(gspca_dev->dev, 0x00e8, bufread, 8);
         reg_w(gspca_dev->dev, 0x00e5, regE5c, 4);
         reg_r(gspca_dev->dev, 0x00e8, &val, 1); /* 0x00 */
 
+        colors = sd->colors;
+        reg51c[0] = 0x77;
+        reg51c[1] = colors;
         reg_w(gspca_dev->dev, 0x0051, reg51c, 2);
         reg_w(gspca_dev->dev, 0x0010, reg10, 2);
         reg_w(gspca_dev->dev, 0x0070, &reg70, 1);
@@ -938,14 +943,15 @@ static void setcontrast(struct gspca_dev*gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
         __u8 regE5acx[] = { 0x88, 0x0a, 0x0c, 0x01 };   /* seem MSB */
-        /* __u8 regE5bcx[]={0x88,0x0b,0x12,0x01}; // LSB */
-        __u8 reg51c[] = { 0x77, 0x03 };
+/*      __u8 regE5bcx[] = { 0x88, 0x0b, 0x12, 0x01};     * LSB */
+        __u8 reg51c[2];
         __u8 val;
 
-        reg51c[1] = sd->colors;
         regE5acx[2] = sd->contrast;
         reg_w(gspca_dev->dev, 0x00e5, regE5acx, 4);
         reg_r(gspca_dev->dev, 0x00e8, &val, 1); /* 0x00 */
+        reg51c[0] = 0x77;
+        reg51c[1] = sd->colors;
         reg_w(gspca_dev->dev, 0x0051, reg51c, 2);
         reg_w(gspca_dev->dev, 0x0010, reg10, 2);
         reg_w(gspca_dev->dev, 0x0070, &reg70, 1);