diff options
author | Bharat Nihalani <bnihalani@nvidia.com> | 2013-12-19 23:29:52 -0800 |
---|---|---|
committer | Gerrit Code Review <gerrit2@nvidia.com> | 2013-12-19 23:29:52 -0800 |
commit | 2b2f508eeb26fd48e6c56b8bd59aa7ad1abf5fd3 (patch) | |
tree | 07326c802b07a0477a0d48a1be6d0dfc34507a54 /drivers/media/dvb-frontends/stb0899_drv.c | |
parent | 3321cd648c8ac7af09d52e200ab7816024cfc06d (diff) | |
parent | 4186e42658f8f3e95fa4f87f917872e8a3431057 (diff) |
Merge "Merge tag 'v3.10.24' into HEAD" into dev-kernel-3.10
Diffstat (limited to 'drivers/media/dvb-frontends/stb0899_drv.c')
-rw-r--r-- | drivers/media/dvb-frontends/stb0899_drv.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c index cc278b3d6d5a..2a979cfac146 100644 --- a/drivers/media/dvb-frontends/stb0899_drv.c +++ b/drivers/media/dvb-frontends/stb0899_drv.c @@ -32,6 +32,9 @@ #include "stb0899_priv.h" #include "stb0899_reg.h" +/* Max transfer size done by I2C transfer functions */ +#define MAX_XFER_SIZE 64 + static unsigned int verbose = 0;//1; module_param(verbose, int, 0644); @@ -499,7 +502,7 @@ err: int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, u32 count) { int ret; - u8 buf[2 + count]; + u8 buf[MAX_XFER_SIZE]; struct i2c_msg i2c_msg = { .addr = state->config->demod_address, .flags = 0, @@ -507,6 +510,13 @@ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, .len = 2 + count }; + if (2 + count > sizeof(buf)) { + printk(KERN_WARNING + "%s: i2c wr reg=%04x: len=%d is too big!\n", + KBUILD_MODNAME, reg, count); + return -EINVAL; + } + buf[0] = reg >> 8; buf[1] = reg & 0xff; memcpy(&buf[2], data, count); |