From d7515b8866b60c9526d2d7af37ebcd16c3c5ed97 Mon Sep 17 00:00:00 2001 From: Jarod Wilson Date: Wed, 29 Jun 2011 18:36:19 -0300 Subject: [media] Revert "V4L/DVB: cx23885: Enable Message Signaled Interrupts(MSI)" This reverts commit e38030f3ff02684eb9e25e983a03ad318a10a2ea. MSI flat-out doesn't work right on cx2388x devices yet. There are now multiple reports of cards that hard-lock systems when MSI is enabled, including my own HVR-1250 when trying to use its built-in IR receiver. Disable MSI and it works just fine. Similar for another user's HVR-1270. Issues have also been reported with the HVR-1850 when MSI is enabled, and the 1850 behavior sounds similar to an as-yet-undiagnosed issue I've seen with an 1800. CC: stable@kernel.org CC: Steven Toth CC: Kusanagi Kouichi Signed-off-by: Jarod Wilson Acked-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/cx23885/cx23885-core.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c index 64d9b2136ff6..419777a832ee 100644 --- a/drivers/media/video/cx23885/cx23885-core.c +++ b/drivers/media/video/cx23885/cx23885-core.c @@ -2060,12 +2060,8 @@ static int __devinit cx23885_initdev(struct pci_dev *pci_dev, goto fail_irq; } - if (!pci_enable_msi(pci_dev)) - err = request_irq(pci_dev->irq, cx23885_irq, - IRQF_DISABLED, dev->name, dev); - else - err = request_irq(pci_dev->irq, cx23885_irq, - IRQF_SHARED | IRQF_DISABLED, dev->name, dev); + err = request_irq(pci_dev->irq, cx23885_irq, + IRQF_SHARED | IRQF_DISABLED, dev->name, dev); if (err < 0) { printk(KERN_ERR "%s: can't get IRQ %d\n", dev->name, pci_dev->irq); @@ -2114,7 +2110,6 @@ static void __devexit cx23885_finidev(struct pci_dev *pci_dev) /* unregister stuff */ free_irq(pci_dev->irq, dev); - pci_disable_msi(pci_dev); cx23885_dev_unregister(dev); v4l2_device_unregister(v4l2_dev); -- cgit v1.2.1 From f3e456cb899304bed183247ed3228f7ff855eebd Mon Sep 17 00:00:00 2001 From: Rafi Rubin Date: Sun, 3 Jul 2011 17:13:52 -0300 Subject: [media] mceusb: Timeout unit corrections Unit missmatch in mceusb_handle_command. It should be converting to us, not 1/10th of ms. mceusb_dev_printdata 100us/ms -> 1000us/ms Alter format of fix slightly and update comment to match proper reality. Signed-off-by: Rafi Rubin Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/mceusb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c index 06dfe0957b5e..b928a61736d7 100644 --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -558,9 +558,10 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, char *buf, inout, data1); break; case MCE_CMD_S_TIMEOUT: - /* value is in units of 50us, so x*50/100 or x/2 ms */ + /* value is in units of 50us, so x*50/1000 ms */ dev_info(dev, "%s receive timeout of %d ms\n", - inout, ((data1 << 8) | data2) / 2); + inout, + ((data1 << 8) | data2) * MCE_TIME_UNIT / 1000); break; case MCE_CMD_G_TIMEOUT: dev_info(dev, "Get receive timeout\n"); @@ -847,7 +848,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index) switch (ir->buf_in[index]) { /* 2-byte return value commands */ case MCE_CMD_S_TIMEOUT: - ir->rc->timeout = US_TO_NS((hi << 8 | lo) / 2); + ir->rc->timeout = US_TO_NS((hi << 8 | lo) * MCE_TIME_UNIT); break; /* 1-byte return value commands */ -- cgit v1.2.1 From 9824ae4aff2793947ea78c4c8147bb6c59efdcba Mon Sep 17 00:00:00 2001 From: Rafi Rubin Date: Sun, 3 Jul 2011 17:13:53 -0300 Subject: [media] mceusb: increase default timeout to 100ms This matches the typical timeout advertised by hardware, once we're actually interpreting it correctly. Signed-off-by: Rafi Rubin Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/mceusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media') diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c index b928a61736d7..ec972dc25790 100644 --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -1079,7 +1079,7 @@ static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir) rc->priv = ir; rc->driver_type = RC_DRIVER_IR_RAW; rc->allowed_protos = RC_TYPE_ALL; - rc->timeout = US_TO_NS(1000); + rc->timeout = MS_TO_NS(100); if (!ir->flags.no_tx) { rc->s_tx_mask = mceusb_set_tx_mask; rc->s_tx_carrier = mceusb_set_tx_carrier; -- cgit v1.2.1 From d7b290a1056c5564eec8a1b169c6e84ff3f54c13 Mon Sep 17 00:00:00 2001 From: Jarod Wilson Date: Mon, 11 Jul 2011 12:09:00 -0300 Subject: [media] nuvoton-cir: make idle timeout more sane The nuvoton-cir inherited an insanely low idle timeout value from the mceusb driver. We're fixing mceusb, should fix this driver too. Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/nuvoton-cir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media') diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c index 565f24c20d77..ce595f9ab4c7 100644 --- a/drivers/media/rc/nuvoton-cir.c +++ b/drivers/media/rc/nuvoton-cir.c @@ -1110,7 +1110,7 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) rdev->dev.parent = &pdev->dev; rdev->driver_name = NVT_DRIVER_NAME; rdev->map_name = RC_MAP_RC6_MCE; - rdev->timeout = US_TO_NS(1000); + rdev->timeout = MS_TO_NS(100); /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */ rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD); #if 0 -- cgit v1.2.1 From 4756fc64ecd628efa6f8296711d7dbcefabf25dd Mon Sep 17 00:00:00 2001 From: Ralf Baechle Date: Fri, 24 Jun 2011 10:30:09 -0300 Subject: [media] MEDIA: Fix non-ISA_DMA_API link failure of sound code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sound/isa/es18xx.c: In function ‘snd_es18xx_playback1_prepare’: sound/isa/es18xx.c:501:9: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/es18xx.c: In function ‘snd_es18xx_playback_pointer’: sound/isa/es18xx.c:818:3: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[2]: *** [sound/isa/es18xx.o] Error 1 sound/isa/sscape.c: In function ‘upload_dma_data’: sound/isa/sscape.c:481:3: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[2]: *** [sound/isa/sscape.o] Error 1 sound/isa/ad1816a/ad1816a_lib.c: In function ‘snd_ad1816a_playback_prepare’: sound/isa/ad1816a/ad1816a_lib.c:244:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/ad1816a/ad1816a_lib.c: In function ‘snd_ad1816a_playback_pointer’: sound/isa/ad1816a/ad1816a_lib.c:302:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] sound/isa/ad1816a/ad1816a_lib.c: In function ‘snd_ad1816a_free’: sound/isa/ad1816a/ad1816a_lib.c:544:3: error: implicit declaration of function ‘snd_dma_disable’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/ad1816a/ad1816a_lib.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/ad1816a] Error 2 sound/isa/es1688/es1688_lib.c: In function ‘snd_es1688_playback_prepare’: sound/isa/es1688/es1688_lib.c:417:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/es1688/es1688_lib.c: In function ‘snd_es1688_playback_pointer’: sound/isa/es1688/es1688_lib.c:509:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/es1688/es1688_lib.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/es1688] Error 2 sound/isa/gus/gus_dma.c: In function ‘snd_gf1_dma_program’: sound/isa/gus/gus_dma.c:79:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/gus/gus_dma.c: In function ‘snd_gf1_dma_done’: sound/isa/gus/gus_dma.c:177:3: error: implicit declaration of function ‘snd_dma_disable’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/gus/gus_dma.o] Error 1 sound/isa/gus/gus_pcm.c: In function ‘snd_gf1_pcm_capture_prepare’: sound/isa/gus/gus_pcm.c:591:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/gus/gus_pcm.c: In function ‘snd_gf1_pcm_capture_pointer’: sound/isa/gus/gus_pcm.c:619:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/gus/gus_pcm.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/gus] Error 2 sound/isa/sb/sb16_csp.c: In function ‘snd_sb_csp_ioctl’: sound/isa/sb/sb16_csp.c:228:227: error: case label does not reduce to an integer constant make[3]: *** [sound/isa/sb/sb16_csp.o] Error 1 sound/isa/sb/sb16_main.c: In function ‘snd_sb16_playback_prepare’: sound/isa/sb/sb16_main.c:276:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/sb/sb16_main.c: In function ‘snd_sb16_playback_pointer’: sound/isa/sb/sb16_main.c:456:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/sb/sb16_main.o] Error 1 sound/isa/sb/sb8_main.c: In function ‘snd_sb8_playback_prepare’: sound/isa/sb/sb8_main.c:172:3: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/sb/sb8_main.c: In function ‘snd_sb8_playback_pointer’: sound/isa/sb/sb8_main.c:425:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/sb/sb8_main.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/sb] Error 2 sound/isa/wss/wss_lib.c: In function ‘snd_wss_playback_prepare’: sound/isa/wss/wss_lib.c:1025:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/wss/wss_lib.c: In function ‘snd_wss_playback_pointer’: sound/isa/wss/wss_lib.c:1160:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] sound/isa/wss/wss_lib.c: In function ‘snd_wss_free’: sound/isa/wss/wss_lib.c:1695:3: error: implicit declaration of function ‘snd_dma_disable’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/wss/wss_lib.o] Error 1 warning: (RADIO_MIROPCM20) selects SND_ISA which has unmet direct dependencies (SOUND && !M68K && SND && ISA && ISA_DMA_API) A build with ISA && ISA_DMA && !ISA_DMA_API results in: CC sound/isa/es18xx.o CC sound/isa/sscape.o CC sound/isa/ad1816a/ad1816a_lib.o CC sound/isa/es1688/es1688_lib.o CC sound/isa/gus/gus_dma.o CC sound/isa/gus/gus_pcm.o CC sound/isa/sb/sb16_csp.o CC sound/isa/sb/sb16_main.o CC sound/isa/sb/sb8_main.o CC sound/isa/wss/wss_lib.o The root cause for this is hidden in this Kconfig warning: Adding a dependency on ISA_DMA_API to RADIO_MIROPCM20 fixes these issues. Signed-off-by: Ralf Baechle Acked-by: Takashi Iwai Signed-off-by: Mauro Carvalho Chehab --- drivers/media/radio/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media') diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig index e4c97fd6f05a..0aeed28e54fd 100644 --- a/drivers/media/radio/Kconfig +++ b/drivers/media/radio/Kconfig @@ -168,7 +168,7 @@ config RADIO_MAXIRADIO config RADIO_MIROPCM20 tristate "miroSOUND PCM20 radio" - depends on ISA && VIDEO_V4L2 && SND + depends on ISA && ISA_DMA_API && VIDEO_V4L2 && SND select SND_ISA select SND_MIRO ---help--- -- cgit v1.2.1 From 42a741dcf1472cea55193ea8611db3d67808ce22 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 30 Jun 2011 14:31:04 -0300 Subject: [media] media: fix radio-sf16fmr2 build when SND is not enabled When CONFIG_SND is not enabled, radio-sf16fmr2 build fails with: so make this driver depend on SND. Signed-off-by: Randy Dunlap Cc: Hans Verkuil Cc: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/radio/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media') diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig index 0aeed28e54fd..52798a111e16 100644 --- a/drivers/media/radio/Kconfig +++ b/drivers/media/radio/Kconfig @@ -201,7 +201,7 @@ config RADIO_SF16FMI config RADIO_SF16FMR2 tristate "SF16FMR2 Radio" - depends on ISA && VIDEO_V4L2 + depends on ISA && VIDEO_V4L2 && SND ---help--- Choose Y here if you have one of these FM radio cards. -- cgit v1.2.1 From 2d1969312d6319d28ae9609a84f969b6933bd51c Mon Sep 17 00:00:00 2001 From: Devin Heitmueller Date: Mon, 4 Jul 2011 21:55:01 -0300 Subject: [media] dvb_frontend: fix race condition in stopping/starting frontend Attached is a patch which addresses a race condition in the DVB core related to closing/reopening the DVB frontend device in quick succession. This is the reason that devices such as the HVR-1300, HVR-3000, and HVR-4000 have been failing to scan properly under MythTV and w_scan. The gory details of the race are described in the patch. Devin There is a race condition exhibited when channel scanners such as w_scan and MythTV quickly close and then reopen the frontend device node. Under normal conditions, the behavior is as follows: 1. Application closes the device node 2. DVB frontend ioctl calls dvb_frontend_release which sets fepriv->release_jiffies 3. DVB frontend thread *eventually* calls dvb_frontend_is_exiting() which compares fepriv->release_jiffies, and shuts down the thread if timeout has expired 4. Thread goes away 5. Application opens frontend device 6. DVB frontend ioctl() calls ts_bus_ctrl(1) 7. DVB frontend ioctl() creates new frontend thread, which calls dvb_frontend_init(), which has demod driver init() routine setup initial register state for demod chip. 8. Tuning request is issued. The race occurs when the application in step 5 performs the new open() call before the frontend thread is shutdown. In this case the ts_bus_ctrl() call is made, which strobes the RESET pin on the demodulator, but the dvb_frontend_init() function never gets called because the frontend thread hasn't gone away yet. As a result, the initial register config for the demod is *never* setup, causing subsequent tuning requests to fail. If there is time between the close and open (enough for the dvb frontend thread to be torn down), then in that case the new frontend thread is created and thus the dvb_frontend_init() function does get called. The fix is to set the flag which forces reinitialization if we did in fact call ts_bus_ctrl(). This problem has been seen on the HVR-1300, HVR-3000, and HVR-4000, and is likely occuring on other designs as well where ts_bus_ctrl() actually strobes the reset pin on the demodulator. Note that this patch should supercede any patches submitted for the 1300/3000/4000 which remove the code that removes GPIO code in cx8802_dvb_advise_acquire(), which have been circulating by users for some time now... Canonical tracking this issue in Launchpad 439163: Thanks to Jon Sayers from Hauppauge and Florent Audebert from Anevia S.A. for providing hardware to test/debug with. Signed-off-by: Devin Heitmueller Cc: Jon Sayers Cc: Florent Audebert Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-core/dvb_frontend.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'drivers/media') diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c index 98278041d75f..5b6b451d4694 100644 --- a/drivers/media/dvb/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb/dvb-core/dvb_frontend.c @@ -1988,6 +1988,14 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl) { if ((ret = fe->ops.ts_bus_ctrl(fe, 1)) < 0) goto err0; + + /* If we took control of the bus, we need to force + reinitialization. This is because many ts_bus_ctrl() + functions strobe the RESET pin on the demod, and if the + frontend thread already exists then the dvb_init() routine + won't get called (which is what usually does initial + register configuration). */ + fepriv->reinitialise = 1; } if ((ret = dvb_generic_open (inode, file)) < 0) -- cgit v1.2.1 From a1ad5ec7f520c559becab2e989a397f1d6ac5eb0 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 13 Jul 2011 01:23:11 -0300 Subject: [media] tuner-core: fix a 2.6.39 regression with mt20xx As Simon reported, digital TV broke with mt20xx tuner due to commit ad020dc2fe9039628cf6cef42cd1b76531ee8411. The mt20xx tuner passes V4L2_TUNER_DIGITAL_TV to tuner core. However, the check_mode code now doesn't handle it well. Change the logic there to avoid the breakage, and fix a test for analog-only at g_tuner. Reported-by: Simon Arlott Tested-by: Simon Arlott Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/tuner-core.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c index cfa9f7efe93d..a03945ab9f08 100644 --- a/drivers/media/video/tuner-core.c +++ b/drivers/media/video/tuner-core.c @@ -714,10 +714,19 @@ static int tuner_remove(struct i2c_client *client) * returns 0. * This function is needed for boards that have a separate tuner for * radio (like devices with tea5767). + * NOTE: mt20xx uses V4L2_TUNER_DIGITAL_TV and calls set_tv_freq to + * select a TV frequency. So, t_mode = T_ANALOG_TV could actually + * be used to represent a Digital TV too. */ static inline int check_mode(struct tuner *t, enum v4l2_tuner_type mode) { - if ((1 << mode & t->mode_mask) == 0) + int t_mode; + if (mode == V4L2_TUNER_RADIO) + t_mode = T_RADIO; + else + t_mode = T_ANALOG_TV; + + if ((t_mode & t->mode_mask) == 0) return -EINVAL; return 0; @@ -984,7 +993,7 @@ static void tuner_status(struct dvb_frontend *fe) case V4L2_TUNER_RADIO: p = "radio"; break; - case V4L2_TUNER_DIGITAL_TV: + case V4L2_TUNER_DIGITAL_TV: /* Used by mt20xx */ p = "digital TV"; break; case V4L2_TUNER_ANALOG_TV: @@ -1135,9 +1144,8 @@ static int tuner_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt) return 0; if (vt->type == t->mode && analog_ops->get_afc) vt->afc = analog_ops->get_afc(&t->fe); - if (vt->type == V4L2_TUNER_ANALOG_TV) + if (t->mode != V4L2_TUNER_RADIO) { vt->capability |= V4L2_TUNER_CAP_NORM; - if (vt->type != V4L2_TUNER_RADIO) { vt->rangelow = tv_range[0] * 16; vt->rangehigh = tv_range[1] * 16; return 0; -- cgit v1.2.1 From dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Sun, 17 Jul 2011 00:24:37 -0300 Subject: si4713-i2c: avoid potential buffer overflow on si4713 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While compiling it with Fedora 15, I noticed this issue: inlined from ‘si4713_write_econtrol_string’ at drivers/media/radio/si4713-i2c.c:1065:24: arch/x86/include/asm/uaccess_32.h:211:26: error: call to ‘copy_from_user_overflow’ declared with attribute error: copy_from_user() buffer size is not provably correct Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab Acked-by: Sakari Ailus Acked-by: Eduardo Valentin Reviewed-by: Eugene Teo Signed-off-by: Linus Torvalds --- drivers/media/radio/si4713-i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c index deca2e06ff22..c9f4a8e65dc4 100644 --- a/drivers/media/radio/si4713-i2c.c +++ b/drivers/media/radio/si4713-i2c.c @@ -1033,7 +1033,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, char ps_name[MAX_RDS_PS_NAME + 1]; len = control->size - 1; - if (len > MAX_RDS_PS_NAME) { + if (len < 0 || len > MAX_RDS_PS_NAME) { rval = -ERANGE; goto exit; } @@ -1057,7 +1057,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, char radio_text[MAX_RDS_RADIO_TEXT + 1]; len = control->size - 1; - if (len > MAX_RDS_RADIO_TEXT) { + if (len < 0 || len > MAX_RDS_RADIO_TEXT) { rval = -ERANGE; goto exit; } -- cgit v1.2.1