V4L/DVB (8829): gspca: Have a clean kmalloc-ated buffer for USB exchanges.

The USB buffer may be used for DMA and there may be a caching problem
if the buffer is part of the device structure.
Thanks to Alan Stern.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 3db5c1e..8c91ffd 100644 (file)
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -124,7 +124,7 @@ static void reg_r(struct gspca_dev *gspca_dev,
        struct usb_device *dev = gspca_dev->dev;
 
 #ifdef GSPCA_DEBUG
-       if (len > sizeof gspca_dev->usb_buf) {
+       if (len > USB_BUF_SZ) {
                err("reg_r: buffer overflow");
                return;
        }
@@ -164,7 +164,7 @@ static void reg_w(struct gspca_dev *gspca_dev,
        struct usb_device *dev = gspca_dev->dev;
 
 #ifdef GSPCA_DEBUG
-       if (len > sizeof gspca_dev->usb_buf) {
+       if (len > USB_BUF_SZ) {
                err("reg_w: buffer overflow");
                return;
        }

diff --git a/drivers/media/video/gspca/etoms.c b/drivers/media/video/gspca/etoms.c
index c03b1f4..9eb6adb 100644 (file)
--- a/drivers/media/video/gspca/etoms.c
+++ b/drivers/media/video/gspca/etoms.c
@@ -235,7 +235,7 @@ static void reg_r(struct gspca_dev *gspca_dev,
        struct usb_device *dev = gspca_dev->dev;
 
 #ifdef GSPCA_DEBUG
-       if (len > sizeof gspca_dev->usb_buf) {
+       if (len > USB_BUF_SZ) {
                err("reg_r: buffer overflow");
                return;
        }
@@ -273,7 +273,7 @@ static void reg_w(struct gspca_dev *gspca_dev,
        struct usb_device *dev = gspca_dev->dev;
 
 #ifdef GSPCA_DEBUG
-       if (len > sizeof gspca_dev->usb_buf) {
+       if (len > USB_BUF_SZ) {
                err("reg_w: buffer overflow");
                return;
        }

diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 42b0b83..7be6928 100644 (file)
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -1731,6 +1731,12 @@ int gspca_dev_probe(struct usb_interface *intf,
                err("couldn't kzalloc gspca struct");
                return -EIO;
        }
+       gspca_dev->usb_buf = kmalloc(USB_BUF_SZ, GFP_KERNEL);
+       if (!gspca_dev->usb_buf) {
+               err("out of memory");
+               ret = -EIO;
+               goto out;
+       }
        gspca_dev->dev = dev;
        gspca_dev->iface = interface->bInterfaceNumber;
        gspca_dev->nbalt = intf->num_altsetting;
@@ -1774,6 +1780,7 @@ int gspca_dev_probe(struct usb_interface *intf,
        PDEBUG(D_PROBE, "probe ok");
        return 0;
 out:
+       kfree(gspca_dev->usb_buf);
        kfree(gspca_dev);
        return ret;
 }
@@ -1806,6 +1813,7 @@ void gspca_disconnect(struct usb_interface *intf)
 /* We don't want people trying to open up the device */
        video_unregister_device(&gspca_dev->vdev);
 /* Free the memory */
+       kfree(gspca_dev->usb_buf);
        kfree(gspca_dev);
        PDEBUG(D_PROBE, "disconnect complete");
 }

diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 7c2f44b..c17625c 100644 (file)
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -127,7 +127,8 @@ struct gspca_dev {
        const struct sd_desc *sd_desc;          /* subdriver description */
        unsigned ctrl_dis;              /* disabled controls (bit map) */
 
-       __u8 usb_buf[8];                        /* buffer for USB exchanges */
+#define USB_BUF_SZ 64
+       __u8 *usb_buf;                          /* buffer for USB exchanges */
        struct urb *urb[MAX_NURBS];
 
        __u8 *frbuf;                            /* buffer for nframes */

diff --git a/drivers/media/video/gspca/mars.c b/drivers/media/video/gspca/mars.c
index 2814759..4d5db47 100644 (file)
--- a/drivers/media/video/gspca/mars.c
+++ b/drivers/media/video/gspca/mars.c
@@ -100,22 +100,6 @@ static int reg_w(struct gspca_dev *gspca_dev,
        return rc;
 }
 
-static int reg_w_buf(struct gspca_dev *gspca_dev,
-                       __u16 index, __u8 *buf, int len)
-{
-       int rc;
-
-       rc = usb_control_msg(gspca_dev->dev,
-                        usb_sndbulkpipe(gspca_dev->dev, 4),
-                        0x12,
-                        0xc8,          /* ?? */
-                        0,             /* value */
-                        index, buf, len, 500);
-       if (rc < 0)
-               PDEBUG(D_ERR, "reg write [%02x] error %d", index, rc);
-       return rc;
-}
-
 static void bulk_w(struct gspca_dev *gspca_dev,
                   __u16 *pch,
                   __u16 Address)
@@ -175,7 +159,6 @@ static void sd_start(struct gspca_dev *gspca_dev)
        /*
           Initialize the MR97113 chip register
         */
-       data = kmalloc(16, GFP_KERNEL);
        data[0] = 0x00;         /* address */
        data[1] = 0x0c | 0x01;  /* reg 0 */
        data[2] = 0x01;         /* reg 1 */
@@ -195,12 +178,10 @@ static void sd_start(struct gspca_dev *gspca_dev)
        data[10] = 0x5d;        /* reg 9, I2C device address
                                 *      [for PAS5101 (0x40)] [for MI (0x5d)] */
 
-       err_code = reg_w_buf(gspca_dev, data[0], data, 11);
-       kfree(data);
+       err_code = reg_w(gspca_dev, data[0], 11);
        if (err_code < 0)
                return;
 
-       data = gspca_dev->usb_buf;
        data[0] = 0x23;         /* address */
        data[1] = 0x09;         /* reg 35, append frame header */
 

diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 044a9ec..162beb3 100644 (file)
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -410,7 +410,7 @@ static void reg_w(struct gspca_dev *gspca_dev,
                  int len)
 {
 #ifdef GSPCA_DEBUG
-       if (len > sizeof gspca_dev->usb_buf) {
+       if (len > USB_BUF_SZ) {
                PDEBUG(D_ERR|D_PACK, "reg_w: buffer overflow");
                return;
        }
@@ -426,26 +426,6 @@ static void reg_w(struct gspca_dev *gspca_dev,
                        500);
 }
 
-static void reg_w_big(struct gspca_dev *gspca_dev,
-                 __u16 value,
-                 const __u8 *buffer,
-                 int len)
-{
-       __u8 *tmpbuf;
-
-       tmpbuf = kmalloc(len, GFP_KERNEL);
-       memcpy(tmpbuf, buffer, len);
-       usb_control_msg(gspca_dev->dev,
-                       usb_sndctrlpipe(gspca_dev->dev, 0),
-                       0x08,                   /* request */
-                       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                       value,
-                       0,                      /* index */
-                       tmpbuf, len,
-                       500);
-       kfree(tmpbuf);
-}
-
 static int i2c_w(struct gspca_dev *gspca_dev, const __u8 *buffer)
 {
        int retry = 60;
@@ -886,7 +866,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
        /* reg 0x17 SensorClk enable inv Clk 0x60 */
        reg_w(gspca_dev, 0x17, &sn9c10x[0x17 - 1], 1);
        /* Set the registers from the template */
-       reg_w_big(gspca_dev, 0x01, sn9c10x, l);
+       reg_w(gspca_dev, 0x01, sn9c10x, l);
        switch (sd->sensor) {
        case SENSOR_HV7131R:
                i2c_w_vector(gspca_dev, hv7131_sensor_init,

diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index feb17db..5697959 100644 (file)
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -613,10 +613,16 @@ static const __u8 qtable4[] = {
        0x29, 0x29, 0x29, 0x29
 };
 
-/* read <len> bytes (len < sizeof gspca_dev->usb_buf) to gspca_dev->usb_buf */
+/* read <len> bytes to gspca_dev->usb_buf */
 static void reg_r(struct gspca_dev *gspca_dev,
                  __u16 value, int len)
 {
+#ifdef GSPCA_DEBUG
+       if (len > USB_BUF_SZ) {
+               err("reg_r: buffer overflow");
+               return;
+       }
+#endif
        usb_control_msg(gspca_dev->dev,
                        usb_rcvctrlpipe(gspca_dev->dev, 0),
                        0,
@@ -649,29 +655,20 @@ static void reg_w(struct gspca_dev *gspca_dev,
 {
        PDEBUG(D_USBO, "reg_w [%02x] = %02x %02x ..",
                value, buffer[0], buffer[1]);
-       if (len <= sizeof gspca_dev->usb_buf) {
-               memcpy(gspca_dev->usb_buf, buffer, len);
-               usb_control_msg(gspca_dev->dev,
-                               usb_sndctrlpipe(gspca_dev->dev, 0),
-                               0x08,
-                          USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                               value, 0,
-                               gspca_dev->usb_buf, len,
-                               500);
-       } else {
-               __u8 *tmpbuf;
-
-               tmpbuf = kmalloc(len, GFP_KERNEL);
-               memcpy(tmpbuf, buffer, len);
-               usb_control_msg(gspca_dev->dev,
-                               usb_sndctrlpipe(gspca_dev->dev, 0),
-                               0x08,
-                          USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                               value, 0,
-                               tmpbuf, len,
-                               500);
-               kfree(tmpbuf);
+#ifdef GSPCA_DEBUG
+       if (len > USB_BUF_SZ) {
+               err("reg_w: buffer overflow");
+               return;
        }
+#endif
+       memcpy(gspca_dev->usb_buf, buffer, len);
+       usb_control_msg(gspca_dev->dev,
+                       usb_sndctrlpipe(gspca_dev->dev, 0),
+                       0x08,
+                       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                       value, 0,
+                       gspca_dev->usb_buf, len,
+                       500);
 }
 
 /* I2C write 1 byte */

diff --git a/drivers/media/video/gspca/sunplus.c b/drivers/media/video/gspca/sunplus.c
index bddf733..1cfcc6c 100644 (file)
--- a/drivers/media/video/gspca/sunplus.c
+++ b/drivers/media/video/gspca/sunplus.c
@@ -449,31 +449,47 @@ static const __u8 qtable_spca504_default[2][64] = {
         0x1e, 0x1e, 0x1e, 0x1e, 0x1e, 0x1e, 0x1e, 0x1e}
 };
 
-static void reg_r(struct usb_device *dev,
-                          __u16 req,
-                          __u16 index,
-                          __u8 *buffer, __u16 length)
+/* read <len> bytes to gspca_dev->usb_buf */
+static void reg_r(struct gspca_dev *gspca_dev,
+                 __u16 req,
+                 __u16 index,
+                 __u16 len)
 {
-       usb_control_msg(dev,
-                       usb_rcvctrlpipe(dev, 0),
+#ifdef GSPCA_DEBUG
+       if (len > USB_BUF_SZ) {
+               err("reg_r: buffer overflow");
+               return;
+       }
+#endif
+       usb_control_msg(gspca_dev->dev,
+                       usb_rcvctrlpipe(gspca_dev->dev, 0),
                        req,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                        0,              /* value */
-                       index, buffer, length,
+                       index,
+                       len ? gspca_dev->usb_buf : NULL, len,
                        500);
 }
 
-static void reg_w(struct usb_device *dev,
-                           __u16 req,
-                           __u16 value,
-                           __u16 index,
-                           __u8 *buffer, __u16 length)
+/* write <len> bytes from gspca_dev->usb_buf */
+static void reg_w(struct gspca_dev *gspca_dev,
+                  __u16 req,
+                  __u16 value,
+                  __u16 index,
+                  __u16 len)
 {
-       usb_control_msg(dev,
-                       usb_sndctrlpipe(dev, 0),
+#ifdef GSPCA_DEBUG
+       if (len > USB_BUF_SZ) {
+               err("reg_w: buffer overflow");
+               return;
+       }
+#endif
+       usb_control_msg(gspca_dev->dev,
+                       usb_sndctrlpipe(gspca_dev->dev, 0),
                        req,
                        USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                       value, index, buffer, length,
+                       value, index,
+                       len ? gspca_dev->usb_buf : NULL, len,
                        500);
 }
 
@@ -634,7 +650,7 @@ static int spca504B_PollingDataReady(struct gspca_dev *gspca_dev)
        int count = 10;
 
        while (--count > 0) {
-               reg_r(gspca_dev->dev, 0x21, 0, gspca_dev->usb_buf, 1);
+               reg_r(gspca_dev, 0x21, 0, 1);
                if ((gspca_dev->usb_buf[0] & 0x01) == 0)
                        break;
                msleep(10);
@@ -644,15 +660,14 @@ static int spca504B_PollingDataReady(struct gspca_dev *gspca_dev)
 
 static void spca504B_WaitCmdStatus(struct gspca_dev *gspca_dev)
 {
-       struct usb_device *dev = gspca_dev->dev;
        int count = 50;
 
        while (--count > 0) {
-               reg_r(dev, 0x21, 1, gspca_dev->usb_buf, 1);
+               reg_r(gspca_dev, 0x21, 1, 1);
                if (gspca_dev->usb_buf[0] != 0) {
                        gspca_dev->usb_buf[0] = 0;
-                       reg_w(dev, 0x21, 0, 1, gspca_dev->usb_buf, 1);
-                       reg_r(dev, 0x21, 1, gspca_dev->usb_buf, 1);
+                       reg_w(gspca_dev, 0x21, 0, 1, 1);
+                       reg_r(gspca_dev, 0x21, 1, 1);
                        spca504B_PollingDataReady(gspca_dev);
                        break;
                }
@@ -662,16 +677,14 @@ static void spca504B_WaitCmdStatus(struct gspca_dev *gspca_dev)
 
 static void spca50x_GetFirmware(struct gspca_dev *gspca_dev)
 {
-       struct usb_device *dev = gspca_dev->dev;
        __u8 *data;
 
-       data = kmalloc(64, GFP_KERNEL);
-       reg_r(dev, 0x20, 0, data, 5);
+       data = gspca_dev->usb_buf;
+       reg_r(gspca_dev, 0x20, 0, 5);
        PDEBUG(D_STREAM, "FirmWare : %d %d %d %d %d ",
                data[0], data[1], data[2], data[3], data[4]);
-       reg_r(dev, 0x23, 0, data, 64);
-       reg_r(dev, 0x23, 1, data, 64);
-       kfree(data);
+       reg_r(gspca_dev, 0x23, 0, 64);
+       reg_r(gspca_dev, 0x23, 1, 64);
 }
 
 static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
@@ -686,21 +699,21 @@ static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
        Type = 0;
        switch (sd->bridge) {
        case BRIDGE_SPCA533:
-               reg_w(dev, 0x31, 0, 0, NULL, 0);
+               reg_w(gspca_dev, 0x31, 0, 0, 0);
                spca504B_WaitCmdStatus(gspca_dev);
                rc = spca504B_PollingDataReady(gspca_dev);
                spca50x_GetFirmware(gspca_dev);
                gspca_dev->usb_buf[0] = 2;                      /* type */
-               reg_w(dev, 0x24, 0, 8, gspca_dev->usb_buf, 1);
-               reg_r(dev, 0x24, 8, gspca_dev->usb_buf, 1);
+               reg_w(gspca_dev, 0x24, 0, 8, 1);
+               reg_r(gspca_dev, 0x24, 8, 1);
 
                gspca_dev->usb_buf[0] = Size;
-               reg_w(dev, 0x25, 0, 4, gspca_dev->usb_buf, 1);
-               reg_r(dev, 0x25, 4, gspca_dev->usb_buf, 1);     /* size */
+               reg_w(gspca_dev, 0x25, 0, 4, 1);
+               reg_r(gspca_dev, 0x25, 4, 1);                   /* size */
                rc = spca504B_PollingDataReady(gspca_dev);
 
                /* Init the cam width height with some values get on init ? */
-               reg_w(dev, 0x31, 0, 4, NULL, 0);
+               reg_w(gspca_dev, 0x31, 0, 4, 0);
                spca504B_WaitCmdStatus(gspca_dev);
                rc = spca504B_PollingDataReady(gspca_dev);
                break;
@@ -708,12 +721,12 @@ static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
 /* case BRIDGE_SPCA504B: */
 /* case BRIDGE_SPCA536: */
                gspca_dev->usb_buf[0] = Size;
-               reg_w(dev, 0x25, 0, 4, gspca_dev->usb_buf, 1);
-               reg_r(dev, 0x25, 4, gspca_dev->usb_buf, 1);     /* size */
+               reg_w(gspca_dev, 0x25, 0, 4, 1);
+               reg_r(gspca_dev, 0x25, 4, 1);                   /* size */
                Type = 6;
                gspca_dev->usb_buf[0] = Type;
-               reg_w(dev, 0x27, 0, 0, gspca_dev->usb_buf, 1);
-               reg_r(dev, 0x27, 0, gspca_dev->usb_buf, 1);     /* type */
+               reg_w(gspca_dev, 0x27, 0, 0, 1);
+               reg_r(gspca_dev, 0x27, 0, 1);                   /* type */
                rc = spca504B_PollingDataReady(gspca_dev);
                break;
        case BRIDGE_SPCA504:
@@ -752,18 +765,15 @@ static void spca504_wait_status(struct gspca_dev *gspca_dev)
 
 static void spca504B_setQtable(struct gspca_dev *gspca_dev)
 {
-       struct usb_device *dev = gspca_dev->dev;
-
        gspca_dev->usb_buf[0] = 3;
-       reg_w(dev, 0x26, 0, 0, gspca_dev->usb_buf, 1);
-       reg_r(dev, 0x26, 0, gspca_dev->usb_buf, 1);
+       reg_w(gspca_dev, 0x26, 0, 0, 1);
+       reg_r(gspca_dev, 0x26, 0, 1);
        spca504B_PollingDataReady(gspca_dev);
 }
 
 static void sp5xx_initContBrigHueRegisters(struct gspca_dev *gspca_dev)
 {
        struct sd *sd = (struct sd *) gspca_dev;
-       struct usb_device *dev = gspca_dev->dev;
        int pollreg = 1;
 
        switch (sd->bridge) {
@@ -774,20 +784,20 @@ static void sp5xx_initContBrigHueRegisters(struct gspca_dev *gspca_dev)
        default:
 /*     case BRIDGE_SPCA533: */
 /*     case BRIDGE_SPCA504B: */
-               reg_w(dev, 0, 0, 0x21a7, NULL, 0);      /* brightness */
-               reg_w(dev, 0, 0x20, 0x21a8, NULL, 0);   /* contrast */
-               reg_w(dev, 0, 0, 0x21ad, NULL, 0);      /* hue */
-               reg_w(dev, 0, 1, 0x21ac, NULL, 0);      /* sat/hue */
-               reg_w(dev, 0, 0x20, 0x21ae, NULL, 0);   /* saturation */
-               reg_w(dev, 0, 0, 0x21a3, NULL, 0);      /* gamma */
+               reg_w(gspca_dev, 0, 0, 0x21a7, 0);      /* brightness */
+               reg_w(gspca_dev, 0, 0x20, 0x21a8, 0);   /* contrast */
+               reg_w(gspca_dev, 0, 0, 0x21ad, 0);      /* hue */
+               reg_w(gspca_dev, 0, 1, 0x21ac, 0);      /* sat/hue */
+               reg_w(gspca_dev, 0, 0x20, 0x21ae, 0);   /* saturation */
+               reg_w(gspca_dev, 0, 0, 0x21a3, 0);      /* gamma */
                break;
        case BRIDGE_SPCA536:
-               reg_w(dev, 0, 0, 0x20f0, NULL, 0);
-               reg_w(dev, 0, 0x21, 0x20f1, NULL, 0);
-               reg_w(dev, 0, 0x40, 0x20f5, NULL, 0);
-               reg_w(dev, 0, 1, 0x20f4, NULL, 0);
-               reg_w(dev, 0, 0x40, 0x20f6, NULL, 0);
-               reg_w(dev, 0, 0, 0x2089, NULL, 0);
+               reg_w(gspca_dev, 0, 0, 0x20f0, 0);
+               reg_w(gspca_dev, 0, 0x21, 0x20f1, 0);
+               reg_w(gspca_dev, 0, 0x40, 0x20f5, 0);
+               reg_w(gspca_dev, 0, 1, 0x20f4, 0);
+               reg_w(gspca_dev, 0, 0x40, 0x20f6, 0);
+               reg_w(gspca_dev, 0, 0, 0x2089, 0);
                break;
        }
        if (pollreg)
@@ -799,7 +809,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
                        const struct usb_device_id *id)
 {
        struct sd *sd = (struct sd *) gspca_dev;
-       struct usb_device *dev = gspca_dev->dev;
        struct cam *cam;
 
        cam = &gspca_dev->cam;
@@ -811,7 +820,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
        if (sd->subtype == AiptekMiniPenCam13) {
 /* try to get the firmware as some cam answer 2.0.1.2.2
  * and should be a spca504b then overwrite that setting */
-               reg_r(dev, 0x20, 0, gspca_dev->usb_buf, 1);
+               reg_r(gspca_dev, 0x20, 0, 1);
                switch (gspca_dev->usb_buf[0]) {
                case 1:
                        break;          /* (right bridge/subtype) */
@@ -860,12 +869,12 @@ static int sd_init(struct gspca_dev *gspca_dev)
 
        switch (sd->bridge) {
        case BRIDGE_SPCA504B:
-               reg_w(dev, 0x1d, 0, 0, NULL, 0);
-               reg_w(dev, 0, 1, 0x2306, NULL, 0);
-               reg_w(dev, 0, 0, 0x0d04, NULL, 0);
-               reg_w(dev, 0, 0, 0x2000, NULL, 0);
-               reg_w(dev, 0, 0x13, 0x2301, NULL, 0);
-               reg_w(dev, 0, 0, 0x2306, NULL, 0);
+               reg_w(gspca_dev, 0x1d, 0, 0, 0);
+               reg_w(gspca_dev, 0, 1, 0x2306, 0);
+               reg_w(gspca_dev, 0, 0, 0x0d04, 0);
+               reg_w(gspca_dev, 0, 0, 0x2000, 0);
+               reg_w(gspca_dev, 0, 0x13, 0x2301, 0);
+               reg_w(gspca_dev, 0, 0, 0x2306, 0);
                /* fall thru */
        case BRIDGE_SPCA533:
                rc = spca504B_PollingDataReady(gspca_dev);
@@ -873,12 +882,12 @@ static int sd_init(struct gspca_dev *gspca_dev)
                break;
        case BRIDGE_SPCA536:
                spca50x_GetFirmware(gspca_dev);
-               reg_r(dev, 0x00, 0x5002, gspca_dev->usb_buf, 1);
+               reg_r(gspca_dev, 0x00, 0x5002, 1);
                gspca_dev->usb_buf[0] = 0;
-               reg_w(dev, 0x24, 0, 0, gspca_dev->usb_buf, 1);
-               reg_r(dev, 0x24, 0, gspca_dev->usb_buf, 1);
+               reg_w(gspca_dev, 0x24, 0, 0, 1);
+               reg_r(gspca_dev, 0x24, 0, 1);
                rc = spca504B_PollingDataReady(gspca_dev);
-               reg_w(dev, 0x34, 0, 0, NULL, 0);
+               reg_w(gspca_dev, 0x34, 0, 0, 0);
                spca504B_WaitCmdStatus(gspca_dev);
                break;
        case BRIDGE_SPCA504C:   /* pccam600 */
@@ -971,12 +980,12 @@ static void sd_start(struct gspca_dev *gspca_dev)
 /*     case BRIDGE_SPCA536: */
                if (sd->subtype == MegapixV4 ||
                    sd->subtype == LogitechClickSmart820) {
-                       reg_w(dev, 0xf0, 0, 0, NULL, 0);
+                       reg_w(gspca_dev, 0xf0, 0, 0, 0);
                        spca504B_WaitCmdStatus(gspca_dev);
-                       reg_r(dev, 0xf0, 4, NULL, 0);
+                       reg_r(gspca_dev, 0xf0, 4, 0);
                        spca504B_WaitCmdStatus(gspca_dev);
                } else {
-                       reg_w(dev, 0x31, 0, 4, NULL, 0);
+                       reg_w(gspca_dev, 0x31, 0, 4, 0);
                        spca504B_WaitCmdStatus(gspca_dev);
                        rc = spca504B_PollingDataReady(gspca_dev);
                }
@@ -1045,7 +1054,7 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 /*     case BRIDGE_SPCA533: */
 /*     case BRIDGE_SPCA536: */
 /*     case BRIDGE_SPCA504B: */
-               reg_w(dev, 0x31, 0, 0, NULL, 0);
+               reg_w(gspca_dev, 0x31, 0, 0, 0);
                spca504B_WaitCmdStatus(gspca_dev);
                spca504B_PollingDataReady(gspca_dev);
                break;

diff --git a/drivers/media/video/gspca/t613.c b/drivers/media/video/gspca/t613.c
index 81b175e..f034c74 100644 (file)
--- a/drivers/media/video/gspca/t613.c
+++ b/drivers/media/video/gspca/t613.c
@@ -391,7 +391,7 @@ static void reg_w(struct gspca_dev *gspca_dev,
                                NULL, 0, 500);
                return;
        }
-       if (len <= sizeof gspca_dev->usb_buf) {
+       if (len <= USB_BUF_SZ) {
                memcpy(gspca_dev->usb_buf, buffer, len);
                usb_control_msg(gspca_dev->dev,
                                usb_sndctrlpipe(gspca_dev->dev, 0),