Merge branch 'perf/urgent' into perf/core, to resolve a conflict

[firefly-linux-kernel-4.4.55.git] / drivers / media / dvb-frontends / ascot2e.c

diff --git a/drivers/media/dvb-frontends/ascot2e.c b/drivers/media/dvb-frontends/ascot2e.c
index ae7e463c2f9bd6b57a36aa8ead5b6e541ccbabf9..f770f6a2c987b00356e25d39d15bc7024c35c115 100644 (file)
--- a/drivers/media/dvb-frontends/ascot2e.c
+++ b/drivers/media/dvb-frontends/ascot2e.c
@@ -26,6 +26,8 @@
 #include "ascot2e.h"
 #include "dvb_frontend.h"
 
+#define MAX_WRITE_REGSIZE 10
+
 enum ascot2e_state {
        STATE_UNKNOWN,
        STATE_SLEEP,
@@ -120,16 +122,22 @@ static int ascot2e_write_regs(struct ascot2e_priv *priv,
                              u8 reg, const u8 *data, u32 len)
 {
        int ret;
-       u8 buf[len+1];
+       u8 buf[MAX_WRITE_REGSIZE + 1];
        struct i2c_msg msg[1] = {
                {
                        .addr = priv->i2c_address,
                        .flags = 0,
-                       .len = sizeof(buf),
+                       .len = len + 1,
                        .buf = buf,
                }
        };
 
+       if (len + 1 >= sizeof(buf)) {
+               dev_warn(&priv->i2c->dev,"wr reg=%04x: len=%d is too big!\n",
+                        reg, len + 1);
+               return -E2BIG;
+       }
+
        ascot2e_i2c_debug(priv, reg, 1, data, len);
        buf[0] = reg;
        memcpy(&buf[1], data, len);