Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck...

[linux-drm-fsl-dcu.git] / drivers / media / dvb-frontends / stb0899_drv.c

diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c
index 3dd5714eadba579c62e347718a073db83889a13a..07cd5ea7a03811c1c01204ac9eb6b42458bb2a6f 100644 (file)
--- a/drivers/media/dvb-frontends/stb0899_drv.c
+++ b/drivers/media/dvb-frontends/stb0899_drv.c
@@ -32,6 +32,9 @@
 #include "stb0899_priv.h"
 #include "stb0899_reg.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static unsigned int verbose = 0;//1;
 module_param(verbose, int, 0644);
 
@@ -499,7 +502,7 @@ err:
 int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, u32 count)
 {
        int ret;
-       u8 buf[2 + count];
+       u8 buf[MAX_XFER_SIZE];
        struct i2c_msg i2c_msg = {
                .addr   = state->config->demod_address,
                .flags  = 0,
@@ -507,6 +510,13 @@ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data,
                .len    = 2 + count
        };
 
+       if (2 + count > sizeof(buf)) {
+               printk(KERN_WARNING
+                      "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                      KBUILD_MODNAME, reg, count);
+               return -EINVAL;
+       }
+
        buf[0] = reg >> 8;
        buf[1] = reg & 0xff;
        memcpy(&buf[2], data, count);