From 3d1d6e4b0c1f31b914328c6db797409f6abaf124 Mon Sep 17 00:00:00 2001 From: Venkateshwarlu Domakonda Date: Fri, 9 Dec 2011 15:08:58 +0530 Subject: [PATCH] radio: iris: Fix the crash with get signal threshold command. Access to unallocated memory is causing the crash. Correct the implementation of returning the response to get signal threshold command. Change-Id: I920e984f68fbcfef82ad2f6e9d252f42c0b815d9 CRs-Fixed: 330569 Signed-off-by: Venkateshwarlu Domakonda --- drivers/media/radio/radio-iris.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/media/radio/radio-iris.c b/drivers/media/radio/radio-iris.c index 5ed2ad7fb65..ff0e00db303 100644 --- a/drivers/media/radio/radio-iris.c +++ b/drivers/media/radio/radio-iris.c @@ -97,6 +97,7 @@ struct iris_device { struct hci_fm_riva_poke riva_data_req; struct hci_fm_ssbi_req ssbi_data_accs; struct hci_fm_ssbi_peek ssbi_peek_reg; + struct hci_fm_sig_threshold_rsp sig_th; }; static struct video_device *priv_videodev; @@ -1587,13 +1588,11 @@ static void hci_cc_sig_threshold_rsp(struct radio_hci_dev *hdev, { struct hci_fm_sig_threshold_rsp *rsp = (void *)skb->data; struct iris_device *radio = video_get_drvdata(video_get_dev()); - struct v4l2_control *v4l_ctl = radio->g_ctl; if (rsp->status) return; - v4l_ctl->value = rsp->sig_threshold; - + memcpy(&radio->sig_th, rsp, sizeof(struct hci_fm_sig_threshold_rsp)); radio_hci_req_complete(hdev, rsp->status); } @@ -2433,6 +2432,11 @@ static int iris_vidioc_g_ctrl(struct file *file, void *priv, break; case V4L2_CID_PRIVATE_IRIS_SIGNAL_TH: retval = hci_cmd(HCI_FM_GET_SIGNAL_TH_CMD, radio->fm_hdev); + if (retval < 0) { + FMDERR("Error in get signal threshold %d\n", retval); + return retval; + } + ctrl->value = radio->sig_th.sig_threshold; break; case V4L2_CID_PRIVATE_IRIS_SRCH_PTY: ctrl->value = radio->srch_rds.srch_pty;