Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media build fixes from Mauro Carvalho Chehab: "A series of patches that fix compilation on non-x86 archs. While most of them are just build fixes, there are some fixes for real bugs, as there are a number of drivers using dynamic stack allocation. A few of those might be considered a security risk, if the i2c-dev module is loaded, as someone could be sending very long I2C data that could potentially overflow the Kernel stack. Ok, as using /dev/i2c-* devnodes usually requires root on usual distros, and exploiting it would require a DVB board or USB stick, the risk is not high" * 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits) [media] platform drivers: Fix build on frv arch [media] lirc_zilog: Don't use dynamic static allocation [media] mxl111sf: Don't use dynamic static allocation [media] af9035: Don't use dynamic static allocation [media] af9015: Don't use dynamic static allocation [media] dw2102: Don't use dynamic static allocation [media] dibusb-common: Don't use dynamic static allocation [media] cxusb: Don't use dynamic static allocation [media] v4l2-async: Don't use dynamic static allocation [media] cimax2: Don't use dynamic static allocation [media] tuner-xc2028: Don't use dynamic static allocation [media] tuners: Don't use dynamic static allocation [media] av7110_hw: Don't use dynamic static allocation [media] stv090x: Don't use dynamic static allocation [media] stv0367: Don't use dynamic static allocation [media] stb0899_drv: Don't use dynamic static allocation [media] dvb-frontends: Don't use dynamic static allocation [media] dvb-frontends: Don't use dynamic static allocation [media] s5h1420: Don't use dynamic static allocation [media] uvc/lirc_serial: Fix some warnings on parisc arch ...
This commit is contained in:
@@ -21,20 +21,30 @@
|
||||
#include "e4000_priv.h"
|
||||
#include <linux/math64.h>
|
||||
|
||||
/* Max transfer size done by I2C transfer functions */
|
||||
#define MAX_XFER_SIZE 64
|
||||
|
||||
/* write multiple registers */
|
||||
static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
|
||||
{
|
||||
int ret;
|
||||
u8 buf[1 + len];
|
||||
u8 buf[MAX_XFER_SIZE];
|
||||
struct i2c_msg msg[1] = {
|
||||
{
|
||||
.addr = priv->cfg->i2c_addr,
|
||||
.flags = 0,
|
||||
.len = sizeof(buf),
|
||||
.len = 1 + len,
|
||||
.buf = buf,
|
||||
}
|
||||
};
|
||||
|
||||
if (1 + len > sizeof(buf)) {
|
||||
dev_warn(&priv->i2c->dev,
|
||||
"%s: i2c wr reg=%04x: len=%d is too big!\n",
|
||||
KBUILD_MODNAME, reg, len);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
buf[0] = reg;
|
||||
memcpy(&buf[1], val, len);
|
||||
|
||||
@@ -54,7 +64,7 @@ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
|
||||
static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
|
||||
{
|
||||
int ret;
|
||||
u8 buf[len];
|
||||
u8 buf[MAX_XFER_SIZE];
|
||||
struct i2c_msg msg[2] = {
|
||||
{
|
||||
.addr = priv->cfg->i2c_addr,
|
||||
@@ -64,11 +74,18 @@ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
|
||||
}, {
|
||||
.addr = priv->cfg->i2c_addr,
|
||||
.flags = I2C_M_RD,
|
||||
.len = sizeof(buf),
|
||||
.len = len,
|
||||
.buf = buf,
|
||||
}
|
||||
};
|
||||
|
||||
if (len > sizeof(buf)) {
|
||||
dev_warn(&priv->i2c->dev,
|
||||
"%s: i2c rd reg=%04x: len=%d is too big!\n",
|
||||
KBUILD_MODNAME, reg, len);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
ret = i2c_transfer(priv->i2c, msg, 2);
|
||||
if (ret == 2) {
|
||||
memcpy(val, buf, len);
|
||||
|
Reference in New Issue
Block a user