---

yaml
---
r: 330799
b: refs/heads/master
c: 884bfd0
h: refs/heads/master
i:
  330797: fa66720
  330795: 52e4cbb
  330791: cef9590
  330783: 7976e39
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7c0bd96b767da250e5aa5ee135c530d87454d9fe
+refs/heads/master: 884bfd08e3d4f694574e54bd1886cd8817d9b986

trunk/drivers/media/rc/iguanair.c

@@ -327,25 +327,30 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 {
 	struct iguanair *ir = dev->priv;
 	uint8_t space, *payload;
-	unsigned i, size, rc;
+	unsigned i, size, rc, bytes;
 	struct send_packet *packet;
 
 	mutex_lock(&ir->lock);
 
 	/* convert from us to carrier periods */
 	for (i = size = 0; i < count; i++) {
 		txbuf[i] = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
-		size += (txbuf[i] + 126) / 127;
+		bytes = (txbuf[i] + 126) / 127;
+		if (size + bytes > ir->bufsize) {
+			count = i;
+			break;
+		}
+		size += bytes;
 	}
 
-	packet = kmalloc(sizeof(*packet) + size, GFP_KERNEL);
-	if (!packet) {
-		rc = -ENOMEM;
+	if (count == 0) {
+		rc = -EINVAL;
 		goto out;
 	}
 
-	if (size > ir->bufsize) {
-		rc = -E2BIG;
+	packet = kmalloc(sizeof(*packet) + size, GFP_KERNEL);
+	if (!packet) {
+		rc = -ENOMEM;
 		goto out;
 	}
 
@@ -376,7 +381,7 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 		rc = iguanair_receiver(ir, false);
 		if (rc) {
 			dev_warn(ir->dev, "disable receiver before transmit failed\n");
-			goto out;
+			goto out_kfree;
 		}
 	}
 
@@ -392,11 +397,12 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
 			dev_warn(ir->dev, "re-enable receiver after transmit failed\n");
 	}
 
+out_kfree:
+	kfree(packet);
 out:
 	mutex_unlock(&ir->lock);
-	kfree(packet);
 
-	return rc;
+	return rc ? rc : count;
 }
 
 static int iguanair_open(struct rc_dev *rdev)
@@ -444,7 +450,7 @@ static int __devinit iguanair_probe(struct usb_interface *intf,
 	ir = kzalloc(sizeof(*ir), GFP_KERNEL);
 	rc = rc_allocate_device();
 	if (!ir || !rc) {
-		ret = ENOMEM;
+		ret = -ENOMEM;
 		goto out;
 	}
 
@@ -453,7 +459,7 @@ static int __devinit iguanair_probe(struct usb_interface *intf,
 	ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
 
 	if (!ir->buf_in || !ir->urb_in) {
-		ret = ENOMEM;
+		ret = -ENOMEM;
 		goto out;
 	}