From c405aa6c90860943c07487067f7dae698d0b305a Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hans.verkuil@cisco.com>
Date: Thu, 25 Aug 2011 09:59:16 -0300
Subject: [PATCH] --- yaml --- r: 271749 b: refs/heads/master c:
 2122eaf64acd9ca42645b4bf8f222c7d452313f1 h: refs/heads/master i:   271747:
 569f3f8796c542e916aae2efd9c7d8d29e8748c7 v: v3

---
 [refs]                                           | 2 +-
 trunk/drivers/media/dvb/ddbridge/ddbridge-core.c | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/[refs] b/[refs]
index b639c9064ffa..0247c798a1eb 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7b4668efc4a8f75d12337cf8013307a7ec437878
+refs/heads/master: 2122eaf64acd9ca42645b4bf8f222c7d452313f1
diff --git a/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c b/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c
index fe56703cecfb..ba9a643b9c6a 100644
--- a/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c
+++ b/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c
@@ -507,15 +507,14 @@ static u32 ddb_input_avail(struct ddb_input *input)
 	return 0;
 }
 
-static size_t ddb_input_read(struct ddb_input *input, u8 *buf, size_t count)
+static ssize_t ddb_input_read(struct ddb_input *input, u8 *buf, size_t count)
 {
 	struct ddb *dev = input->port->dev;
 	u32 left = count;
-	u32 idx, off, free, stat = input->stat;
+	u32 idx, free, stat = input->stat;
 	int ret;
 
 	idx = (stat >> 11) & 0x1f;
-	off = (stat & 0x7ff) << 7;
 
 	while (left) {
 		if (input->cbuf == idx)
@@ -525,6 +524,8 @@ static size_t ddb_input_read(struct ddb_input *input, u8 *buf, size_t count)
 			free = left;
 		ret = copy_to_user(buf, input->vbuf[input->cbuf] +
 				   input->coff, free);
+		if (ret)
+			return -EFAULT;
 		input->coff += free;
 		if (input->coff == input->dma_buf_size) {
 			input->coff = 0;
@@ -939,6 +940,8 @@ static ssize_t ts_read(struct file *file, char *buf,
 				break;
 		}
 		read = ddb_input_read(input, buf, left);
+		if (read < 0)
+			return read;
 		left -= read;
 		buf += read;
 	}