[media] iguanair: do not modify transmit buffer

Since commit "[media] rc-core: move timeout and checks to lirc", the
incoming buffer is used after the driver transmits.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 21 insertions, 30 deletions

diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 66ba23738601..1e4c68a5cecf 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -334,21 +334,34 @@ static int iguanair_set_tx_mask(struct rc_dev *dev, uint32_t mask)
 static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 {
 	struct iguanair *ir = dev->priv;
-	uint8_t space, *payload;
-	unsigned i, size, rc, bytes;
+	uint8_t space;
+	unsigned i, size, periods, bytes;
+	int rc;
 	struct send_packet *packet;
 
 	mutex_lock(&ir->lock);
 
+	packet = kmalloc(sizeof(*packet) + ir->bufsize, GFP_KERNEL);
+	if (!packet) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
 	/* convert from us to carrier periods */
-	for (i = size = 0; i < count; i++) {
-		txbuf[i] = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
-		bytes = (txbuf[i] + 126) / 127;
+	for (i = space = size = 0; i < count; i++) {
+		periods = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
+		bytes = DIV_ROUND_UP(periods, 127);
 		if (size + bytes > ir->bufsize) {
 			count = i;
 			break;
 		}
-		size += bytes;
+		while (periods > 127) {
+			packet->payload[size++] = 127 | space;
+			periods -= 127;
+		}
+
+		packet->payload[size++] = periods | space;
+		space ^= 0x80;
 	}
 
 	if (count == 0) {
@@ -356,12 +369,6 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 		goto out;
 	}
 
-	packet = kmalloc(sizeof(*packet) + size, GFP_KERNEL);
-	if (!packet) {
-		rc = -ENOMEM;
-		goto out;
-	}
-
 	packet->header.start = 0;
 	packet->header.direction = DIR_OUT;
 	packet->header.cmd = CMD_SEND;
@@ -370,26 +377,11 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 	packet->busy7 = ir->busy7;
 	packet->busy4 = ir->busy4;
 
-	space = 0;
-	payload = packet->payload;
-
-	for (i = 0; i < count; i++) {
-		unsigned periods = txbuf[i];
-
-		while (periods > 127) {
-			*payload++ = 127 | space;
-			periods -= 127;
-		}
-
-		*payload++ = periods | space;
-		space ^= 0x80;
-	}
-
 	if (ir->receiver_on) {
 		rc = iguanair_receiver(ir, false);
 		if (rc) {
 			dev_warn(ir->dev, "disable receiver before transmit failed\n");
-			goto out_kfree;
+			goto out;
 		}
 	}
 
@@ -405,9 +397,8 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 			dev_warn(ir->dev, "re-enable receiver after transmit failed\n");
 	}
 
-out_kfree:
-	kfree(packet);
 out:
+	kfree(packet);
 	mutex_unlock(&ir->lock);
 
 	return rc ? rc : count;