V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.

gspca:    Protect dq_callback() against simultaneous USB exchanges.
          Temporary buffer for USB exchanges added in the device struct.
(all)     Use a temporary buffer for all USB exchanges.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 100 insertions, 99 deletions

diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index bac45a193653..548c4c8c3f33 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -24,8 +24,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>, "
 		"Serge A. Suchkov <Serge.A.S@tochka.ru>");
@@ -6214,23 +6214,27 @@ static const struct usb_action tas5130c_vf0250_NoFlikerScale[] = {
 	{}
 };
 
-static void reg_r_i(struct usb_device *dev,
-		__u16 index, __u8 *buffer)
+static int reg_r_i(struct gspca_dev *gspca_dev,
+		__u16 index)
 {
-	usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			0xa1,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0x01,			/* value */
-			index, buffer, 1,
+			index, gspca_dev->usb_buf, 1,
 			500);
+	return gspca_dev->usb_buf[0];
 }
 
-static void reg_r(struct usb_device *dev,
-		__u16 index, __u8 *buffer)
+static int reg_r(struct gspca_dev *gspca_dev,
+		__u16 index)
 {
-	reg_r_i(dev, index, buffer);
-	PDEBUG(D_USBI, "reg r [%04x] -> %02x", index, *buffer);
+	int ret;
+
+	ret = reg_r_i(gspca_dev, index);
+	PDEBUG(D_USBI, "reg r [%04x] -> %02x", index, ret);
+	return ret;
 }
 
 static void reg_w_i(struct usb_device *dev,
@@ -6253,55 +6257,54 @@ static void reg_w(struct usb_device *dev,
 	reg_w_i(dev, value, index);
 }
 
-static __u16 i2c_read(struct usb_device *dev, __u8 reg)
+static __u16 i2c_read(struct gspca_dev *gspca_dev,
+			__u8 reg)
 {
 	__u8 retbyte;
 	__u8 retval[2];
 
-	reg_w_i(dev, reg, 0x92);
-	reg_w_i(dev, 0x02, 0x90);		/* <- read command */
+	reg_w_i(gspca_dev->dev, reg, 0x92);
+	reg_w_i(gspca_dev->dev, 0x02, 0x90);		/* <- read command */
 	msleep(25);
-	reg_r_i(dev, 0x0091, &retbyte);		/* read status */
-	reg_r_i(dev, 0x0095, &retval[0]);	/* read Lowbyte */
-	reg_r_i(dev, 0x0096, &retval[1]);	/* read Hightbyte */
+	retbyte = reg_r_i(gspca_dev, 0x0091);		/* read status */
+	retval[0] = reg_r_i(gspca_dev, 0x0095);		/* read Lowbyte */
+	retval[1] = reg_r_i(gspca_dev, 0x0096);		/* read Hightbyte */
 	PDEBUG(D_USBO, "i2c r [%02x] -> (%02x) %02x%02x",
 			reg, retbyte, retval[1], retval[0]);
 	return (retval[1] << 8) | retval[0];
 }
 
-static __u8 i2c_write(struct usb_device *dev,
+static __u8 i2c_write(struct gspca_dev *gspca_dev,
 			__u8 reg,
 			__u8 valL,
 			__u8 valH)
 {
 	__u8 retbyte;
 
-	reg_w_i(dev, reg, 0x92);
-	reg_w_i(dev, valL, 0x93);
-	reg_w_i(dev, valH, 0x94);
-	reg_w_i(dev, 0x01, 0x90);		/* <- write command */
+	reg_w_i(gspca_dev->dev, reg, 0x92);
+	reg_w_i(gspca_dev->dev, valL, 0x93);
+	reg_w_i(gspca_dev->dev, valH, 0x94);
+	reg_w_i(gspca_dev->dev, 0x01, 0x90);		/* <- write command */
 	msleep(5);
-	reg_r_i(dev, 0x0091, &retbyte);		/* read status */
+	retbyte = reg_r_i(gspca_dev, 0x0091);		/* read status */
 	PDEBUG(D_USBO, "i2c w [%02x] %02x%02x (%02x)",
 			reg, valH, valL, retbyte);
 	return retbyte;
 }
 
-static void usb_exchange(struct usb_device *dev,
+static void usb_exchange(struct gspca_dev *gspca_dev,
 			const struct usb_action *action)
 {
-	__u8 buffread;
-
 	while (action->req) {
 		switch (action->req) {
 		case 0xa0:	/* write register */
-			reg_w(dev, action->val, action->idx);
+			reg_w(gspca_dev->dev, action->val, action->idx);
 			break;
 		case 0xa1:	/* read status */
-			reg_r(dev, action->idx, &buffread);
+			reg_r(gspca_dev, action->idx);
 			break;
 		case 0xaa:
-			i2c_write(dev,
+			i2c_write(gspca_dev,
 				  action->val,			/* reg */
 				  action->idx & 0xff,		/* valL */
 				  action->idx >> 8);		/* valH */
@@ -6376,7 +6379,6 @@ static void setsharpness(struct gspca_dev *gspca_dev)
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
 	int sharpness;
-	__u8 retbyte;
 	static const __u8 sharpness_tb[][2] = {
 		{0x02, 0x03},
 		{0x04, 0x07},
@@ -6386,9 +6388,9 @@ static void setsharpness(struct gspca_dev *gspca_dev)
 
 	sharpness = sd->sharpness;
 	reg_w(dev, sharpness_tb[sharpness][0], 0x01c6);
-	reg_r(dev, 0x01c8, &retbyte);
-	reg_r(dev, 0x01c9, &retbyte);
-	reg_r(dev, 0x01ca, &retbyte);
+	reg_r(gspca_dev, 0x01c8);
+	reg_r(gspca_dev, 0x01c9);
+	reg_r(gspca_dev, 0x01ca);
 	reg_w(dev, sharpness_tb[sharpness][1], 0x01cb);
 }
 
@@ -6398,7 +6400,7 @@ static void setcontrast(struct gspca_dev *gspca_dev)
 	struct usb_device *dev = gspca_dev->dev;
 	const __u8 *Tgamma, *Tgradient;
 	int g, i, k;
-	static const __u8 kgamma_tb[16] =		/* delta for contrast */
+	static const __u8 kgamma_tb[16] =	/* delta for contrast */
 		{0x15, 0x0d, 0x0a, 0x09, 0x08, 0x08, 0x08, 0x08,
 		 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08};
 	static const __u8 kgrad_tb[16] =
@@ -6623,7 +6625,7 @@ static int setlightfreq(struct gspca_dev *gspca_dev)
 		i++;			/* 640x480 */
 	zc3_freq = freq_tb[(int) sd->sensor][i];
 	if (zc3_freq != NULL) {
-		usb_exchange(gspca_dev->dev, zc3_freq);
+		usb_exchange(gspca_dev, zc3_freq);
 		switch (sd->sensor) {
 		case SENSOR_GC0305:
 			if (mode			/* if 320x240 */
@@ -6687,44 +6689,45 @@ static void start_2wr_probe(struct usb_device *dev, int sensor)
 /*	msleep(2); */
 }
 
-static int sif_probe(struct usb_device *dev)
+static int sif_probe(struct gspca_dev *gspca_dev)
 {
 	__u16 checkword;
 
-	start_2wr_probe(dev, 0x0f);		/* PAS106 */
-	reg_w(dev, 0x08, 0x008d);
+	start_2wr_probe(gspca_dev->dev, 0x0f);		/* PAS106 */
+	reg_w(gspca_dev->dev, 0x08, 0x008d);
 	msleep(150);
-	checkword = ((i2c_read(dev, 0x00) & 0x0f) << 4)
-			| ((i2c_read(dev, 0x01) & 0xf0) >> 4);
+	checkword = ((i2c_read(gspca_dev, 0x00) & 0x0f) << 4)
+			| ((i2c_read(gspca_dev, 0x01) & 0xf0) >> 4);
 	PDEBUG(D_PROBE, "probe sif 0x%04x", checkword);
 	if (checkword == 0x0007) {
-		send_unknown(dev, SENSOR_PAS106);
+		send_unknown(gspca_dev->dev, SENSOR_PAS106);
 		return 0x0f;			/* PAS106 */
 	}
 	return -1;
 }
 
-static int vga_2wr_probe(struct usb_device *dev)
+static int vga_2wr_probe(struct gspca_dev *gspca_dev)
 {
+	struct usb_device *dev = gspca_dev->dev;
 	__u8 retbyte;
 	__u16 checkword;
 
 	start_2wr_probe(dev, 0x00);		/* HV7131B */
-	i2c_write(dev, 0x01, 0xaa, 0x00);
-	retbyte = i2c_read(dev, 0x01);
+	i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x01);
 	if (retbyte != 0)
 		return 0x00;			/* HV7131B */
 
 	start_2wr_probe(dev, 0x04);		/* CS2102 */
-	i2c_write(dev, 0x01, 0xaa, 0x00);
-	retbyte = i2c_read(dev, 0x01);
+	i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x01);
 	if (retbyte != 0)
 		return 0x04;			/* CS2102 */
 
 	start_2wr_probe(dev, 0x06);		/* OmniVision */
 	reg_w(dev, 0x08, 0x8d);
-	i2c_write(dev, 0x11, 0xaa, 0x00);
-	retbyte = i2c_read(dev, 0x11);
+	i2c_write(gspca_dev, 0x11, 0xaa, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x11);
 	if (retbyte != 0) {
 		/* (should have returned 0xaa) --> Omnivision? */
 		/* reg_r 0x10 -> 0x06 -->  */
@@ -6732,45 +6735,45 @@ static int vga_2wr_probe(struct usb_device *dev)
 	}
 
 	start_2wr_probe(dev, 0x08);		/* HDCS2020 */
-	i2c_write(dev, 0x15, 0xaa, 0x00);
-	retbyte = i2c_read(dev, 0x15);
+	i2c_write(gspca_dev, 0x15, 0xaa, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x15);
 	if (retbyte != 0)
 		return 0x08;			/* HDCS2020 */
 
 	start_2wr_probe(dev, 0x0a);		/* PB0330 */
-	i2c_write(dev, 0x07, 0xaa, 0xaa);
-	retbyte = i2c_read(dev, 0x07);
+	i2c_write(gspca_dev, 0x07, 0xaa, 0xaa);
+	retbyte = i2c_read(gspca_dev, 0x07);
 	if (retbyte != 0)
 		return 0x0a;			/* PB0330 */
-	retbyte = i2c_read(dev, 0x03);
+	retbyte = i2c_read(gspca_dev, 0x03);
 	if (retbyte != 0)
 		return 0x0a;			/* PB0330 ?? */
-	retbyte = i2c_read(dev, 0x04);
+	retbyte = i2c_read(gspca_dev, 0x04);
 	if (retbyte != 0)
 		return 0x0a;			/* PB0330 ?? */
 
 	start_2wr_probe(dev, 0x0c);		/* ICM105A */
-	i2c_write(dev, 0x01, 0x11, 0x00);
-	retbyte = i2c_read(dev, 0x01);
+	i2c_write(gspca_dev, 0x01, 0x11, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x01);
 	if (retbyte != 0)
 		return 0x0c;			/* ICM105A */
 
 	start_2wr_probe(dev, 0x0e);		/* PAS202BCB */
 	reg_w(dev, 0x08, 0x8d);
-	i2c_write(dev, 0x03, 0xaa, 0x00);
+	i2c_write(gspca_dev, 0x03, 0xaa, 0x00);
 	msleep(500);
-	retbyte = i2c_read(dev, 0x03);
+	retbyte = i2c_read(gspca_dev, 0x03);
 	if (retbyte != 0)
 		return 0x0e;			/* PAS202BCB */
 
 	start_2wr_probe(dev, 0x02);		/* ?? */
-	i2c_write(dev, 0x01, 0xaa, 0x00);
-	retbyte = i2c_read(dev, 0x01);
+	i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x01);
 	if (retbyte != 0)
 		return 0x02;			/* ?? */
 ov_check:
-	reg_r(dev, 0x0010, &retbyte);		/* ?? */
-	reg_r(dev, 0x0010, &retbyte);
+	reg_r(gspca_dev, 0x0010);		/* ?? */
+	reg_r(gspca_dev, 0x0010);
 
 	reg_w(dev, 0x01, 0x0000);
 	reg_w(dev, 0x01, 0x0001);
@@ -6779,10 +6782,10 @@ ov_check:
 	reg_w(dev, 0x08, 0x008d);
 	msleep(500);
 	reg_w(dev, 0x01, 0x0012);
-	i2c_write(dev, 0x12, 0x80, 0x00);	/* sensor reset */
-	retbyte = i2c_read(dev, 0x0a);
+	i2c_write(gspca_dev, 0x12, 0x80, 0x00);	/* sensor reset */
+	retbyte = i2c_read(gspca_dev, 0x0a);
 	checkword = retbyte << 8;
-	retbyte = i2c_read(dev, 0x0b);
+	retbyte = i2c_read(gspca_dev, 0x0b);
 	checkword |= retbyte;
 	PDEBUG(D_PROBE, "probe 2wr ov vga 0x%04x", checkword);
 	switch (checkword) {
@@ -6821,7 +6824,7 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 
 /*fixme: lack of 8b=b3 (11,12)-> 10, 8b=e0 (14,15,16)-> 12 found in gspcav1*/
 	reg_w(dev, 0x02, 0x0010);
-	reg_r(dev, 0x10, &retbyte);
+	reg_r(gspca_dev, 0x10);
 	reg_w(dev, 0x01, 0x0000);
 	reg_w(dev, 0x00, 0x0010);
 	reg_w(dev, 0x01, 0x0001);
@@ -6829,23 +6832,23 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0x03, 0x0012);
 	reg_w(dev, 0x01, 0x0012);
 	reg_w(dev, 0x05, 0x0012);
-	retbyte = i2c_read(dev, 0x14);
+	retbyte = i2c_read(gspca_dev, 0x14);
 	if (retbyte != 0)
 		return 0x11;			/* HV7131R */
-	retbyte = i2c_read(dev, 0x15);
+	retbyte = i2c_read(gspca_dev, 0x15);
 	if (retbyte != 0)
 		return 0x11;			/* HV7131R */
-	retbyte = i2c_read(dev, 0x16);
+	retbyte = i2c_read(gspca_dev, 0x16);
 	if (retbyte != 0)
 		return 0x11;			/* HV7131R */
 
 	reg_w(dev, 0x02, 0x0010);
-	reg_r(dev, 0x000b, &retbyte);
+	retbyte = reg_r(gspca_dev, 0x000b);
 	checkword = retbyte << 8;
-	reg_r(dev, 0x000a, &retbyte);
+	retbyte = reg_r(gspca_dev, 0x000a);
 	checkword |= retbyte;
 	PDEBUG(D_PROBE, "probe 3wr vga 1 0x%04x", checkword);
-	reg_r(dev, 0x0010, &retbyte);
+	reg_r(gspca_dev, 0x0010);
 	/* this is tested only once anyway */
 	i = 0;
 	while (chipset_revision_sensor[i].revision) {
@@ -6863,7 +6866,7 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0x0a, 0x0010);
 	reg_w(dev, 0x03, 0x0012);
 	reg_w(dev, 0x01, 0x0012);
-	retbyte = i2c_read(dev, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x00);
 	if (retbyte != 0) {
 		PDEBUG(D_PROBE, "probe 3wr vga type 0a ?");
 		return 0x0a;			/* ?? */
@@ -6876,7 +6879,7 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0x03, 0x0012);
 	msleep(2);
 	reg_w(dev, 0x01, 0x0012);
-	retbyte = i2c_read(dev, 0x00);
+	retbyte = i2c_read(gspca_dev, 0x00);
 	if (retbyte != 0) {
 		PDEBUG(D_PROBE, "probe 3wr vga type %02x", retbyte);
 		send_unknown(dev, SENSOR_GC0305);
@@ -6890,8 +6893,8 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0x06, 0x0010);
 	reg_w(dev, 0x01, 0x0012);
 	reg_w(dev, 0x05, 0x0012);
-	if (i2c_read(dev, 0x1c) == 0x7f	/* OV7610 - manufacturer ID */
-	    && i2c_read(dev, 0x1d) == 0xa2) {
+	if (i2c_read(gspca_dev, 0x1c) == 0x7f	/* OV7610 - manufacturer ID */
+	    && i2c_read(gspca_dev, 0x1d) == 0xa2) {
 		send_unknown(dev, SENSOR_OV7620);
 		return 0x06;		/* OmniVision confirm ? */
 	}
@@ -6905,13 +6908,13 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 /*	msleep(150); */
 	reg_w(dev, 0x01, 0x12);
 	reg_w(dev, 0x05, 0x12);
-	retbyte = i2c_read(dev, 0x00);		/* ID 0 */
+	retbyte = i2c_read(gspca_dev, 0x00);		/* ID 0 */
 	checkword = retbyte << 8;
-	retbyte = i2c_read(dev, 0x01);		/* ID 1 */
+	retbyte = i2c_read(gspca_dev, 0x01);		/* ID 1 */
 	checkword |= retbyte;
 	PDEBUG(D_PROBE, "probe 3wr vga 2 0x%04x", checkword);
 	if (checkword == 0x2030) {
-		retbyte = i2c_read(dev, 0x02);	/* revision number */
+		retbyte = i2c_read(gspca_dev, 0x02);	/* revision number */
 		PDEBUG(D_PROBE, "sensor PO2030 rev 0x%02x", retbyte);
 		send_unknown(dev, SENSOR_PO2030);
 		return checkword;
@@ -6925,7 +6928,7 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0x01, 0x12);
 	reg_w(dev, 0x05, 0x01);
 	reg_w(dev, 0xd3, 0x8b);
-	retbyte = i2c_read(dev, 0x01);
+	retbyte = i2c_read(gspca_dev, 0x01);
 	if (retbyte != 0) {
 		PDEBUG(D_PROBE, "probe 3wr vga type 0a ?");
 		return 0x0a;			/* ?? */
@@ -6936,7 +6939,6 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 static int zcxx_probeSensor(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	int sensor, sensor2;
 
 	switch (sd->sensor) {
@@ -6944,7 +6946,7 @@ static int zcxx_probeSensor(struct gspca_dev *gspca_dev)
 	case SENSOR_TAS5130C_VF0250:
 		return -1;		/* don't probe */
 	}
-	sensor = vga_2wr_probe(dev);
+	sensor = vga_2wr_probe(gspca_dev);
 	if (sensor >= 0) {
 		if (sensor < 0x7600)
 			return sensor;
@@ -6956,7 +6958,7 @@ static int zcxx_probeSensor(struct gspca_dev *gspca_dev)
 			return sensor;
 		return sensor2;
 	}
-	return sif_probe(dev);
+	return sif_probe(gspca_dev);
 }
 
 /* this function is called at probe time */
@@ -6966,7 +6968,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct cam *cam;
 	int sensor;
-	__u8 bsensor;
 	int vga = 1;		/* 1: vga, 0: sif */
 	static const __u8 gamma[SENSOR_MAX] = {
 		5,	/* SENSOR_CS2102 0 */
@@ -7122,7 +7123,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 			reg_w(gspca_dev->dev, 0x02, 0x0010);
 		else
 			reg_w(gspca_dev->dev, sensor & 0x0f, 0x0010);
-		reg_r(gspca_dev->dev, 0x0010, &bsensor);
+		reg_r(gspca_dev, 0x0010);
 	}
 
 	cam = &gspca_dev->cam;
@@ -7163,7 +7164,6 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	struct usb_device *dev = gspca_dev->dev;
 	const struct usb_action *zc3_init;
 	int mode;
-	__u8 retbyte;
 	static const struct usb_action *init_tb[SENSOR_MAX][2] = {
 		{cs2102_InitialScale, cs2102_Initial},		/* 0 */
 		{cs2102K_InitialScale, cs2102K_Initial},	/* 1 */
@@ -7194,7 +7194,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
 		zcxx_probeSensor(gspca_dev);
 		break;
 	case SENSOR_PAS106:
-		usb_exchange(dev, pas106b_Initial_com);
+		usb_exchange(gspca_dev, pas106b_Initial_com);
 		break;
 	case SENSOR_PB0330:
 		if (mode) {
@@ -7210,14 +7210,14 @@ static void sd_start(struct gspca_dev *gspca_dev)
 		}
 		break;
 	}
-	usb_exchange(dev, zc3_init);
+	usb_exchange(gspca_dev, zc3_init);
 
 	switch (sd->sensor) {
 	case SENSOR_GC0305:
 	case SENSOR_OV7620:
 	case SENSOR_PO2030:
 		msleep(100);			/* ?? */
-		reg_r(dev, 0x0002, &retbyte);	/* --> 0x40 */
+		reg_r(gspca_dev, 0x0002);	/* --> 0x40 */
 		reg_w(dev, 0x09, 0x01ad);	/* (from win traces) */
 		reg_w(dev, 0x15, 0x01ae);
 		reg_w(dev, 0x0d, 0x003a);
@@ -7230,11 +7230,11 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	setbrightness(gspca_dev);
 	switch (sd->sensor) {
 	case SENSOR_OV7620:
-		reg_r(dev, 0x0008, &retbyte);
+		reg_r(gspca_dev, 0x0008);
 		reg_w(dev, 0x00, 0x0008);
 		break;
 	case SENSOR_GC0305:
-		reg_r(dev, 0x0008, &retbyte);
+		reg_r(gspca_dev, 0x0008);
 		/* fall thru */
 	case SENSOR_PO2030:
 		reg_w(dev, 0x03, 0x0008);
@@ -7259,7 +7259,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	setmatrix(gspca_dev);			/* one more time? */
 	switch (sd->sensor) {
 	case SENSOR_OV7620:
-		reg_r(dev, 0x0180, &retbyte);	/* from win */
+		reg_r(gspca_dev, 0x0180);	/* from win */
 		reg_w(dev, 0x00, 0x0180);
 		break;
 	default:
@@ -7277,7 +7277,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
 		break;
 	case SENSOR_PO2030:
 		reg_w(dev, 0x40, 0x0117);	/* (from win traces) */
-		reg_r(dev, 0x0180, &retbyte);
+		reg_r(gspca_dev, 0x0180);
 		break;
 	}
 
@@ -7289,22 +7289,23 @@ static void sd_start(struct gspca_dev *gspca_dev)
 		reg_w(dev, 0x15, 0x01ae);
 		reg_w(dev, 0x40, 0x0180);
 		reg_w(dev, 0x40, 0x0117);
-		reg_r(dev, 0x0180, &retbyte);
+		reg_r(gspca_dev, 0x0180);
 		sd->autogain = 1;
 		setautogain(gspca_dev);
 		break;
 	case SENSOR_OV7620:
-		i2c_read(dev, 0x13);		/*fixme: returns 0xa3 */
-		i2c_write(dev, 0x13, 0xa3, 0x00); /*fixme: same to send? */
+		i2c_read(gspca_dev, 0x13);	/*fixme: returns 0xa3 */
+		i2c_write(gspca_dev, 0x13, 0xa3, 0x00);
+					 /*fixme: returned value to send? */
 		reg_w(dev, 0x40, 0x0117);	/* (from win traces) */
-		reg_r(dev, 0x0180, &retbyte);
+		reg_r(gspca_dev, 0x0180);
 		setautogain(gspca_dev);
 		msleep(500);
 		break;
 	case SENSOR_PO2030:
 		msleep(500);
-		reg_r(dev, 0x0008, &retbyte);
-		reg_r(dev, 0x0007, &retbyte);
+		reg_r(gspca_dev, 0x0008);
+		reg_r(gspca_dev, 0x0007);
 		reg_w(dev, 0x00, 0x0007);	/* (from win traces) */
 		reg_w(dev, 0x02, 0x0008);
 		break;