1 files changed, 8 insertions, 7 deletions

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 5d7b4eaa6a3c..51620e02292f 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
                           u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
         struct cxusb_state *st = d->priv;
-        int ret, wo;
+        int ret;
 
         if (1 + wlen > MAX_XFER_SIZE) {
                 warn("i2c wr: len=%d is too big!\n", wlen);
                 return -EOPNOTSUPP;
         }
 
-        wo = (rbuf == NULL || rlen == 0); /* write-only */
+        if (rlen > MAX_XFER_SIZE) {
+                warn("i2c rd: len=%d is too big!\n", rlen);
+                return -EOPNOTSUPP;
+        }
 
         mutex_lock(&d->data_mutex);
         st->data[0] = cmd;
         memcpy(&st->data[1], wbuf, wlen);
-        if (wo)
-                ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
-        else
-                ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
-                                         rbuf, rlen, 0);
+        ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
+        if (!ret && rbuf && rlen)
+                memcpy(rbuf, st->data, rlen);
 
         mutex_unlock(&d->data_mutex);
         return ret;