[09/20] V4L/DVB (13190): em28xx: fix panic that can occur when starting audio streaming

[Greg KH <gregkh@suse.de>]

[-- Attachment #1: v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch --]
[-- Type: text/plain, Size: 1270 bytes --]

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Devin Heitmueller <dheitmueller@kernellabs.com>

commit 96fbf771d86a90ff006bc62ca4d4de6474b3de31 upstream.

Because the counters were not reset when starting up streaming, they would
be reused from the previous run.  This can result in cases such that when the
second instance of streaming starts up, the "cnt" variable in
em28xx_audio_isocirq() can end up being negative, resulting in attempting to
write to memory before the start of runtime->dma_area (as well as having a
negative number of bytes to copy).

Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/media/video/em28xx/em28xx-audio.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -365,6 +365,11 @@ static int snd_em28xx_hw_capture_free(st
 
 static int snd_em28xx_prepare(struct snd_pcm_substream *substream)
 {
+	struct em28xx *dev = snd_pcm_substream_chip(substream);
+
+	dev->adev.hwptr_done_capture = 0;
+	dev->adev.capture_transfer_done = 0;
+
 	return 0;
 }