diff options
Diffstat (limited to 'drivers/media/dvb-frontends/stb6100.c')
| -rw-r--r-- | drivers/media/dvb-frontends/stb6100.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c index 2e93e65d2cd..4ef8a5c7003 100644 --- a/drivers/media/dvb-frontends/stb6100.c +++ b/drivers/media/dvb-frontends/stb6100.c @@ -31,6 +31,8 @@ static unsigned int verbose; module_param(verbose, int, 0644); +/* Max transfer size done by I2C transfer functions */ +#define MAX_XFER_SIZE 64 #define FE_ERROR 0 #define FE_NOTICE 1 @@ -183,7 +185,7 @@ static int stb6100_read_reg(struct stb6100_state *state, u8 reg) static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int start, int len) { int rc; - u8 cmdbuf[len + 1]; + u8 cmdbuf[MAX_XFER_SIZE]; struct i2c_msg msg = { .addr = state->config->tuner_address, .flags = 0, @@ -191,6 +193,13 @@ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int st .len = len + 1 }; + if (1 + len > sizeof(cmdbuf)) { + printk(KERN_WARNING + "%s: i2c wr: len=%d is too big!\n", + KBUILD_MODNAME, len); + return -EINVAL; + } + if (unlikely(start < 1 || start + len > STB6100_NUMREGS)) { dprintk(verbose, FE_ERROR, 1, "Invalid register range %d:%d", start, len); @@ -575,8 +584,8 @@ struct dvb_frontend *stb6100_attach(struct dvb_frontend *fe, struct stb6100_state *state = NULL; state = kzalloc(sizeof (struct stb6100_state), GFP_KERNEL); - if (state == NULL) - goto error; + if (!state) + return NULL; state->config = config; state->i2c = i2c; @@ -587,10 +596,6 @@ struct dvb_frontend *stb6100_attach(struct dvb_frontend *fe, printk("%s: Attaching STB6100 \n", __func__); return fe; - -error: - kfree(state); - return NULL; } static int stb6100_release(struct dvb_frontend *fe) |