1 files changed, 36 insertions, 22 deletions

diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5d837c16ee2..15e2b525310 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -69,19 +69,33 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg,
 	int ret, byte;
 
 	if (dev->state & DEV_DISCONNECTED)
-		return(-ENODEV);
+		return -ENODEV;
+
+	if (len > URB_MAX_CTRL_SIZE)
+		return -EINVAL;
 
 	em28xx_regdbg("req=%02x, reg=%02x ", req, reg);
 
+	mutex_lock(&dev->ctrl_urb_lock);
 	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			      0x0000, reg, buf, len, HZ);
+			      0x0000, reg, dev->urb_buf, len, HZ);
+	if (ret < 0) {
+		if (reg_debug)
+			printk(" failed!\n");
+		mutex_unlock(&dev->ctrl_urb_lock);
+		return ret;
+	}
+
+	if (len)
+		memcpy(buf, dev->urb_buf, len);
+
+	mutex_unlock(&dev->ctrl_urb_lock);
 
 	if (reg_debug) {
-		printk(ret < 0 ? " failed!\n" : "%02x values: ", ret);
+		printk("%02x values: ", ret);
 		for (byte = 0; byte < len; byte++)
 			printk(" %02x", (unsigned char)buf[byte]);
-
 		printk("\n");
 	}
 
@@ -102,16 +116,20 @@ int em28xx_read_reg_req(struct em28xx *dev, u8 req, u16 reg)
 
 	em28xx_regdbg("req=%02x, reg=%02x:", req, reg);
 
+	mutex_lock(&dev->ctrl_urb_lock);
 	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			      0x0000, reg, &val, 1, HZ);
-
-	if (reg_debug)
-		printk(ret < 0 ? " failed!\n" :
-				 "%02x\n", (unsigned char) val);
+			      0x0000, reg, dev->urb_buf, 1, HZ);
+	val = dev->urb_buf[0];
+	mutex_unlock(&dev->ctrl_urb_lock);
 
-	if (ret < 0)
+	if (ret < 0) {
+		printk(" failed!\n");
 		return ret;
+	}
+
+	if (reg_debug)
+		printk("%02x\n", (unsigned char) val);
 
 	return val;
 }
@@ -130,19 +148,13 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 {
 	int ret;
 
-	/*usb_control_msg seems to expect a kmalloced buffer */
-	unsigned char *bufs;
-
 	if (dev->state & DEV_DISCONNECTED)
 		return -ENODEV;
 
-	if (len < 1)
+	if ((len < 1) || (len > URB_MAX_CTRL_SIZE))
 		return -EINVAL;
 
-	bufs = kmalloc(len, GFP_KERNEL);
-
 	em28xx_regdbg("req=%02x reg=%02x:", req, reg);
-
 	if (reg_debug) {
 		int i;
 		for (i = 0; i < len; ++i)
@@ -150,16 +162,16 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 		printk("\n");
 	}
 
-	if (!bufs)
-		return -ENOMEM;
-	memcpy(bufs, buf, len);
+	mutex_lock(&dev->ctrl_urb_lock);
+	memcpy(dev->urb_buf, buf, len);
 	ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req,
 			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			      0x0000, reg, bufs, len, HZ);
+			      0x0000, reg, dev->urb_buf, len, HZ);
+	mutex_unlock(&dev->ctrl_urb_lock);
+
 	if (dev->wait_after_write)
 		msleep(dev->wait_after_write);
 
-	kfree(bufs);
 	return ret;
 }
 
@@ -270,6 +282,8 @@ static int em28xx_set_audio_source(struct em28xx *dev)
 			break;
 		case EM28XX_AMUX_LINE_IN:
 			input = EM28XX_AUDIO_SRC_LINE;
+			video = disable;
+			line  = enable;
 			break;
 		case EM28XX_AMUX_AC97_VIDEO:
 			input = EM28XX_AUDIO_SRC_LINE;