1 files changed, 23 insertions, 25 deletions

diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c
index a31734b7842..4709e592e2c 100644
--- a/sound/oss/opl3.c
+++ b/sound/oss/opl3.c
@@ -1,5 +1,5 @@
 /*
- * sound/opl3.c
+ * sound/oss/opl3.c
  *
  * A low level driver for Yamaha YM3812 and OPL-3 -chips
  *
@@ -24,6 +24,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/delay.h>
 
@@ -34,7 +35,6 @@
 
 #include "sound_config.h"
 
-#include "opl3.h"
 #include "opl3_hw.h"
 
 #define MAX_VOICE	18
@@ -73,7 +73,6 @@ typedef struct opl_devinfo
 	unsigned char   cmask;
 
 	int             is_opl4;
-	int            *osp;
 } opl_devinfo;
 
 static struct opl_devinfo *devc = NULL;
@@ -144,7 +143,7 @@ static int opl3_ioctl(int dev, unsigned int cmd, void __user * arg)
 	}
 }
 
-int opl3_detect(int ioaddr, int *osp)
+static int opl3_detect(int ioaddr)
 {
 	/*
 	 * This function returns 1 if the FM chip is present at the given I/O port
@@ -166,7 +165,7 @@ int opl3_detect(int ioaddr, int *osp)
 		return 0;
 	}
 
-	devc = (struct opl_devinfo *)kmalloc(sizeof(*devc), GFP_KERNEL);
+	devc = kzalloc(sizeof(*devc), GFP_KERNEL);
 
 	if (devc == NULL)
 	{
@@ -175,7 +174,6 @@ int opl3_detect(int ioaddr, int *osp)
 		return 0;
 	}
 
-	memset(devc, 0, sizeof(*devc));
 	strcpy(devc->fm_info.name, "OPL2");
 
 	if (!request_region(ioaddr, 4, devc->fm_info.name)) {
@@ -183,7 +181,6 @@ int opl3_detect(int ioaddr, int *osp)
 		goto cleanup_devc;
 	}
 
-	devc->osp = osp;
 	devc->base = ioaddr;
 
 	/* Reset timers 1 and 2 */
@@ -278,7 +275,6 @@ static int opl3_kill_note  (int devno, int voice, int note, int velocity)
 	 devc->v_alloc->map[voice] = 0;
 
 	 map = &pv_map[devc->lv_map[voice]];
-	 DEB(printk("Kill note %d\n", voice));
 
 	 if (map->voice_mode == 0)
 		 return 0;
@@ -823,7 +819,7 @@ static void opl3_hw_control(int dev, unsigned char *event)
 }
 
 static int opl3_load_patch(int dev, int format, const char __user *addr,
-		int offs, int count, int pmgr_flag)
+		int count, int pmgr_flag)
 {
 	struct sbi_instrument ins;
 
@@ -833,11 +829,7 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
 		return -EINVAL;
 	}
 
-	/*
-	 * What the fuck is going on here?  We leave junk in the beginning
-	 * of ins and then check the field pretty close to that beginning?
-	 */
-	if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs))
+	if (copy_from_user(&ins, addr, sizeof(ins)))
 		return -EFAULT;
 
 	if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)
@@ -852,6 +844,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
 
 static void opl3_panning(int dev, int voice, int value)
 {
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
 	devc->voc[voice].panning = value;
 }
 
@@ -876,8 +872,6 @@ static void opl3_aftertouch(int dev, int voice, int pressure)
 
 	map = &pv_map[devc->lv_map[voice]];
 
-	DEB(printk("Aftertouch %d\n", voice));
-
 	if (map->voice_mode == 0)
 		return;
 
@@ -1069,8 +1063,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
 
 static void opl3_setup_voice(int dev, int voice, int chn)
 {
-	struct channel_info *info =
-	&synth_devs[dev]->chn_info[chn];
+	struct channel_info *info;
+
+	if (voice < 0 || voice >= devc->nr_voice)
+		return;
+
+	if (chn < 0 || chn > 15)
+		return;
+
+	info = &synth_devs[dev]->chn_info[chn];
 
 	opl3_set_instr(dev, voice, info->pgm_num);
 
@@ -1106,7 +1107,7 @@ static struct synth_operations opl3_operations =
 	.setup_voice	= opl3_setup_voice
 };
 
-int opl3_init(int ioaddr, int *osp, struct module *owner)
+static int opl3_init(int ioaddr, struct module *owner)
 {
 	int i;
 	int me;
@@ -1186,7 +1187,7 @@ int opl3_init(int ioaddr, int *osp, struct module *owner)
 
 		for (i = 0; i < 18; i++)
 			pv_map[i].ioaddr = devc->left_io;
-	};
+	}
 	conf_printf2(devc->fm_info.name, ioaddr, 0, -1, -1);
 
 	for (i = 0; i < SBFM_MAXINSTR; i++)
@@ -1195,9 +1196,6 @@ int opl3_init(int ioaddr, int *osp, struct module *owner)
 	return me;
 }
 
-EXPORT_SYMBOL(opl3_init);
-EXPORT_SYMBOL(opl3_detect);
-
 static int me;
 
 static int io = -1;
@@ -1210,12 +1208,12 @@ static int __init init_opl3 (void)
 
 	if (io != -1)	/* User loading pure OPL3 module */
 	{
-		if (!opl3_detect(io, NULL))
+		if (!opl3_detect(io))
 		{
 			return -ENODEV;
 		}
 
-		me = opl3_init(io, NULL, THIS_MODULE);
+		me = opl3_init(io, THIS_MODULE);
 	}
 
 	return 0;