Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media build fixes from Mauro Carvalho Chehab:
 "A series of patches that fix compilation on non-x86 archs.

  While most of them are just build fixes, there are some fixes for real
  bugs, as there are a number of drivers using dynamic stack allocation.
  A few of those might be considered a security risk, if the i2c-dev
  module is loaded, as someone could be sending very long I2C data that
  could potentially overflow the Kernel stack.  Ok, as using /dev/i2c-*
  devnodes usually requires root on usual distros, and exploiting it
  would require a DVB board or USB stick, the risk is not high"

* 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits)
  [media] platform drivers: Fix build on frv arch
  [media] lirc_zilog: Don't use dynamic static allocation
  [media] mxl111sf: Don't use dynamic static allocation
  [media] af9035: Don't use dynamic static allocation
  [media] af9015: Don't use dynamic static allocation
  [media] dw2102: Don't use dynamic static allocation
  [media] dibusb-common: Don't use dynamic static allocation
  [media] cxusb: Don't use dynamic static allocation
  [media] v4l2-async: Don't use dynamic static allocation
  [media] cimax2: Don't use dynamic static allocation
  [media] tuner-xc2028: Don't use dynamic static allocation
  [media] tuners: Don't use dynamic static allocation
  [media] av7110_hw: Don't use dynamic static allocation
  [media] stv090x: Don't use dynamic static allocation
  [media] stv0367: Don't use dynamic static allocation
  [media] stb0899_drv: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] s5h1420: Don't use dynamic static allocation
  [media] uvc/lirc_serial: Fix some warnings on parisc arch
  ...

47 files changed, 610 insertions, 119 deletions

diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
index a204f2828820..fb504f1e9125 100644
--- a/drivers/media/dvb-frontends/af9013.c
+++ b/drivers/media/dvb-frontends/af9013.c
@@ -24,6 +24,9 @@
 
 #include "af9013_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 struct af9013_state {
         struct i2c_adapter *i2c;
         struct dvb_frontend fe;
@@ -50,16 +53,23 @@ static int af9013_wr_regs_i2c(struct af9013_state *priv, u8 mbox, u16 reg,
         const u8 *val, int len)
 {
         int ret;
-        u8 buf[3+len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->config.i2c_addr,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 3 + len,
                         .buf = buf,
                 }
         };
 
+        if (3 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = (reg >> 8) & 0xff;
         buf[1] = (reg >> 0) & 0xff;
         buf[2] = mbox;
diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
index a777b4b944eb..30ee59052157 100644
--- a/drivers/media/dvb-frontends/af9033.c
+++ b/drivers/media/dvb-frontends/af9033.c
@@ -21,6 +21,9 @@
 
 #include "af9033_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 struct af9033_state {
         struct i2c_adapter *i2c;
         struct dvb_frontend fe;
@@ -40,16 +43,23 @@ static int af9033_wr_regs(struct af9033_state *state, u32 reg, const u8 *val,
                 int len)
 {
         int ret;
-        u8 buf[3 + len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = state->cfg.i2c_addr,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 3 + len,
                         .buf = buf,
                 }
         };
 
+        if (3 + len > sizeof(buf)) {
+                dev_warn(&state->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = (reg >> 16) & 0xff;
         buf[1] = (reg >>  8) & 0xff;
         buf[2] = (reg >>  0) & 0xff;
@@ -161,7 +171,14 @@ static int af9033_wr_reg_val_tab(struct af9033_state *state,
                 const struct reg_val *tab, int tab_len)
 {
         int ret, i, j;
-        u8 buf[tab_len];
+        u8 buf[MAX_XFER_SIZE];
+
+        if (tab_len > sizeof(buf)) {
+                dev_warn(&state->i2c->dev,
+                         "%s: i2c wr len=%d is too big!\n",
+                         KBUILD_MODNAME, tab_len);
+                return -EINVAL;
+        }
 
         dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
 
diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c
index 1b77909c0c71..39a29dd29519 100644
--- a/drivers/media/dvb-frontends/bcm3510.c
+++ b/drivers/media/dvb-frontends/bcm3510.c
@@ -44,6 +44,9 @@
 #include "bcm3510.h"
 #include "bcm3510_priv.h"
 
+/* Max transfer size done by bcm3510_do_hab_cmd() function */
+#define MAX_XFER_SIZE   128
+
 struct bcm3510_state {
 
         struct i2c_adapter* i2c;
@@ -201,9 +204,19 @@ static int bcm3510_hab_send_request(struct bcm3510_state *st, u8 *buf, int len)
 
 static int bcm3510_do_hab_cmd(struct bcm3510_state *st, u8 cmd, u8 msgid, u8 *obuf, u8 olen, u8 *ibuf, u8 ilen)
 {
-        u8 ob[olen+2],ib[ilen+2];
+        u8 ob[MAX_XFER_SIZE], ib[MAX_XFER_SIZE];
         int ret = 0;
 
+        if (ilen + 2 > sizeof(ib)) {
+                deb_hab("do_hab_cmd: ilen=%d is too big!\n", ilen);
+                return -EINVAL;
+        }
+
+        if (olen + 2 > sizeof(ob)) {
+                deb_hab("do_hab_cmd: olen=%d is too big!\n", olen);
+                return -EINVAL;
+        }
+
         ob[0] = cmd;
         ob[1] = msgid;
         memcpy(&ob[2],obuf,olen);
diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c
index d9eeeb1dfa96..03930d5e9fea 100644
--- a/drivers/media/dvb-frontends/cxd2820r_core.c
+++ b/drivers/media/dvb-frontends/cxd2820r_core.c
@@ -21,12 +21,15 @@
 
 #include "cxd2820r_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /* write multiple registers */
 static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
         u8 *val, int len)
 {
         int ret;
-        u8 buf[len+1];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = i2c,
@@ -36,6 +39,13 @@ static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
@@ -55,7 +65,7 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
         u8 *val, int len)
 {
         int ret;
-        u8 buf[len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[2] = {
                 {
                         .addr = i2c,
@@ -70,6 +80,13 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,
                 }
         };
 
+        if (len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, buf, len);
diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c
index c1c3400b2173..cadcae4cff89 100644
--- a/drivers/media/dvb-frontends/itd1000.c
+++ b/drivers/media/dvb-frontends/itd1000.c
@@ -31,6 +31,9 @@
 #include "itd1000.h"
 #include "itd1000_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static int debug;
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
@@ -52,10 +55,18 @@ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
 /* don't write more than one byte with flexcop behind */
 static int itd1000_write_regs(struct itd1000_state *state, u8 reg, u8 v[], u8 len)
 {
-        u8 buf[1+len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg = {
                 .addr = state->cfg->i2c_address, .flags = 0, .buf = buf, .len = len+1
         };
+
+        if (1 + len > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "itd1000: i2c wr reg=%04x: len=%d is too big!\n",
+                       reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], v, len);
 
diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c
index ec388c1d6913..a74ac0ddb833 100644
--- a/drivers/media/dvb-frontends/mt312.c
+++ b/drivers/media/dvb-frontends/mt312.c
@@ -36,6 +36,8 @@
 #include "mt312_priv.h"
 #include "mt312.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
 
 struct mt312_state {
         struct i2c_adapter *i2c;
@@ -96,9 +98,15 @@ static int mt312_write(struct mt312_state *state, const enum mt312_reg_addr reg,
                        const u8 *src, const size_t count)
 {
         int ret;
-        u8 buf[count + 1];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg;
 
+        if (1 + count > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "mt312: write: len=%zd is too big!\n", count);
+                return -EINVAL;
+        }
+
         if (debug) {
                 int i;
                 dprintk("W(%d):", reg & 0x7f);
diff --git a/drivers/media/dvb-frontends/nxt200x.c b/drivers/media/dvb-frontends/nxt200x.c
index 8e288940a61f..fbca9856313a 100644
--- a/drivers/media/dvb-frontends/nxt200x.c
+++ b/drivers/media/dvb-frontends/nxt200x.c
@@ -39,6 +39,9 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 #define NXT2002_DEFAULT_FIRMWARE "dvb-fe-nxt2002.fw"
 #define NXT2004_DEFAULT_FIRMWARE "dvb-fe-nxt2004.fw"
 #define CRC_CCIT_MASK 0x1021
@@ -95,10 +98,16 @@ static int i2c_readbytes(struct nxt200x_state *state, u8 addr, u8 *buf, u8 len)
 static int nxt200x_writebytes (struct nxt200x_state* state, u8 reg,
                                const u8 *buf, u8 len)
 {
-        u8 buf2 [len+1];
+        u8 buf2[MAX_XFER_SIZE];
         int err;
         struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, .buf = buf2, .len = len + 1 };
 
+        if (1 + len > sizeof(buf2)) {
+                pr_warn("%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         __func__, reg, len);
+                return -EINVAL;
+        }
+
         buf2[0] = reg;
         memcpy(&buf2[1], buf, len);
 
diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
index 362d26d11e82..7efb796c472c 100644
--- a/drivers/media/dvb-frontends/rtl2830.c
+++ b/drivers/media/dvb-frontends/rtl2830.c
@@ -27,20 +27,30 @@
 
 #include "rtl2830_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /* write multiple hardware registers */
 static int rtl2830_wr(struct rtl2830_priv *priv, u8 reg, const u8 *val, int len)
 {
         int ret;
-        u8 buf[1+len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg.i2c_addr,
                         .flags = 0,
-                        .len = 1+len,
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
index a95dfe0a5ce3..ff73da9365e3 100644
--- a/drivers/media/dvb-frontends/rtl2832.c
+++ b/drivers/media/dvb-frontends/rtl2832.c
@@ -22,6 +22,9 @@
 #include "dvb_math.h"
 #include <linux/bitops.h>
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 int rtl2832_debug;
 module_param_named(debug, rtl2832_debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
@@ -162,16 +165,23 @@ static const struct rtl2832_reg_entry registers[] = {
 static int rtl2832_wr(struct rtl2832_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[1+len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg.i2c_addr,
                         .flags = 0,
-                        .len = 1+len,
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
index e2fec9ebf947..93eeaf7118fd 100644
--- a/drivers/media/dvb-frontends/s5h1420.c
+++ b/drivers/media/dvb-frontends/s5h1420.c
@@ -836,9 +836,16 @@ static u32 s5h1420_tuner_i2c_func(struct i2c_adapter *adapter)
 static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[], int num)
 {
         struct s5h1420_state *state = i2c_get_adapdata(i2c_adap);
-        struct i2c_msg m[1 + num];
+        struct i2c_msg m[3];
         u8 tx_open[2] = { CON_1, state->CON_1_val | 1 }; /* repeater stops once there was a stop condition */
 
+        if (1 + num > ARRAY_SIZE(m)) {
+                printk(KERN_WARNING
+                       "%s: i2c xfer: num=%d is too big!\n",
+                       KBUILD_MODNAME, num);
+                return  -EOPNOTSUPP;
+        }
+
         memset(m, 0, sizeof(struct i2c_msg) * (1 + num));
 
         m[0].addr = state->config->demod_address;
@@ -847,7 +854,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c
 
         memcpy(&m[1], msg, sizeof(struct i2c_msg) * num);
 
-        return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
+        return i2c_transfer(state->i2c, m, 1 + num) == 1 + num ? num : -EIO;
 }
 
 static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c
index 3dd5714eadba..07cd5ea7a038 100644
--- a/drivers/media/dvb-frontends/stb0899_drv.c
+++ b/drivers/media/dvb-frontends/stb0899_drv.c
@@ -32,6 +32,9 @@
 #include "stb0899_priv.h"
 #include "stb0899_reg.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static unsigned int verbose = 0;//1;
 module_param(verbose, int, 0644);
 
@@ -499,7 +502,7 @@ err:
 int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, u32 count)
 {
         int ret;
-        u8 buf[2 + count];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg i2c_msg = {
                 .addr   = state->config->demod_address,
                 .flags  = 0,
@@ -507,6 +510,13 @@ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data,
                 .len    = 2 + count
         };
 
+        if (2 + count > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, count);
+                return -EINVAL;
+        }
+
         buf[0] = reg >> 8;
         buf[1] = reg & 0xff;
         memcpy(&buf[2], data, count);
diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c
index 45f9523f968f..cea175d19890 100644
--- a/drivers/media/dvb-frontends/stb6100.c
+++ b/drivers/media/dvb-frontends/stb6100.c
@@ -31,6 +31,8 @@
 static unsigned int verbose;
 module_param(verbose, int, 0644);
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
 
 #define FE_ERROR                0
 #define FE_NOTICE               1
@@ -183,7 +185,7 @@ static int stb6100_read_reg(struct stb6100_state *state, u8 reg)
 static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int start, int len)
 {
         int rc;
-        u8 cmdbuf[len + 1];
+        u8 cmdbuf[MAX_XFER_SIZE];
         struct i2c_msg msg = {
                 .addr   = state->config->tuner_address,
                 .flags  = 0,
@@ -191,6 +193,13 @@ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int st
                 .len    = len + 1
         };
 
+        if (1 + len > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr: len=%d is too big!\n",
+                       KBUILD_MODNAME, len);
+                return -EINVAL;
+        }
+
         if (unlikely(start < 1 || start + len > STB6100_NUMREGS)) {
                 dprintk(verbose, FE_ERROR, 1, "Invalid register range %d:%d",
                         start, len);
diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
index 7b6dba3ce55e..458772739423 100644
--- a/drivers/media/dvb-frontends/stv0367.c
+++ b/drivers/media/dvb-frontends/stv0367.c
@@ -33,6 +33,9 @@
 #include "stv0367_regs.h"
 #include "stv0367_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static int stvdebug;
 module_param_named(debug, stvdebug, int, 0644);
 
@@ -767,7 +770,7 @@ static struct st_register def0367cab[STV0367CAB_NBREGS] = {
 static
 int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
 {
-        u8 buf[len + 2];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg = {
                 .addr = state->config->demod_address,
                 .flags = 0,
@@ -776,6 +779,14 @@ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
         };
         int ret;
 
+        if (2 + len > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
+
         buf[0] = MSB(reg);
         buf[1] = LSB(reg);
         memcpy(buf + 2, data, len);
diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
index 56d470ad5a82..23e872f84742 100644
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -35,6 +35,9 @@
 #include "stv090x.h"
 #include "stv090x_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static unsigned int verbose;
 module_param(verbose, int, 0644);
 
@@ -722,9 +725,16 @@ static int stv090x_write_regs(struct stv090x_state *state, unsigned int reg, u8
 {
         const struct stv090x_config *config = state->config;
         int ret;
-        u8 buf[2 + count];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg i2c_msg = { .addr = config->address, .flags = 0, .buf = buf, .len = 2 + count };
 
+        if (2 + count > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, count);
+                return -EINVAL;
+        }
+
         buf[0] = reg >> 8;
         buf[1] = reg & 0xff;
         memcpy(&buf[2], data, count);
diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c
index 20b5fa92c53e..b1425830a24e 100644
--- a/drivers/media/dvb-frontends/stv6110.c
+++ b/drivers/media/dvb-frontends/stv6110.c
@@ -30,6 +30,9 @@
 
 #include "stv6110.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static int debug;
 
 struct stv6110_priv {
@@ -68,7 +71,7 @@ static int stv6110_write_regs(struct dvb_frontend *fe, u8 buf[],
 {
         struct stv6110_priv *priv = fe->tuner_priv;
         int rc;
-        u8 cmdbuf[len + 1];
+        u8 cmdbuf[MAX_XFER_SIZE];
         struct i2c_msg msg = {
                 .addr   = priv->i2c_address,
                 .flags  = 0,
@@ -78,6 +81,13 @@ static int stv6110_write_regs(struct dvb_frontend *fe, u8 buf[],
 
         dprintk("%s\n", __func__);
 
+        if (1 + len > sizeof(cmdbuf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr: len=%d is too big!\n",
+                       KBUILD_MODNAME, len);
+                return -EINVAL;
+        }
+
         if (start + len > 8)
                 return -EINVAL;
 
diff --git a/drivers/media/dvb-frontends/stv6110x.c b/drivers/media/dvb-frontends/stv6110x.c
index f36cab12bdc7..e66154e5c1d7 100644
--- a/drivers/media/dvb-frontends/stv6110x.c
+++ b/drivers/media/dvb-frontends/stv6110x.c
@@ -32,6 +32,9 @@
 #include "stv6110x.h"
 #include "stv6110x_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static unsigned int verbose;
 module_param(verbose, int, 0644);
 MODULE_PARM_DESC(verbose, "Set Verbosity level");
@@ -61,7 +64,8 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da
 {
         int ret;
         const struct stv6110x_config *config = stv6110x->config;
-        u8 buf[len + 1];
+        u8 buf[MAX_XFER_SIZE];
+
         struct i2c_msg msg = {
                 .addr = config->addr,
                 .flags = 0,
@@ -69,6 +73,13 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da
                 .len = len + 1
         };
 
+        if (1 + len > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr: len=%d is too big!\n",
+                       KBUILD_MODNAME, len);
+                return -EINVAL;
+        }
+
         if (start + len > 8)
                 return -EINVAL;
 
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index e79749cfec81..8ad3a57cf640 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -20,6 +20,9 @@
 
 #include "tda10071_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static struct dvb_frontend_ops tda10071_ops;
 
 /* write multiple registers */
@@ -27,16 +30,23 @@ static int tda10071_wr_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
         int len)
 {
         int ret;
-        u8 buf[len+1];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg.demod_i2c_addr,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
@@ -56,7 +66,7 @@ static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
         int len)
 {
         int ret;
-        u8 buf[len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[2] = {
                 {
                         .addr = priv->cfg.demod_i2c_addr,
@@ -66,11 +76,18 @@ static int tda10071_rd_regs(struct tda10071_priv *priv, u8 reg, u8 *val,
                 }, {
                         .addr = priv->cfg.demod_i2c_addr,
                         .flags = I2C_M_RD,
-                        .len = sizeof(buf),
+                        .len = len,
                         .buf = buf,
                 }
         };
 
+        if (len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, buf, len);
diff --git a/drivers/media/dvb-frontends/tda18271c2dd.c b/drivers/media/dvb-frontends/tda18271c2dd.c
index d281f77d5c28..2c54586ac07f 100644
--- a/drivers/media/dvb-frontends/tda18271c2dd.c
+++ b/drivers/media/dvb-frontends/tda18271c2dd.c
@@ -34,6 +34,9 @@
 #include "dvb_frontend.h"
 #include "tda18271c2dd.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 struct SStandardParam {
         s32   m_IFFrequency;
         u32   m_BandWidth;
@@ -139,11 +142,18 @@ static int i2c_write(struct i2c_adapter *adap, u8 adr, u8 *data, int len)
 static int WriteRegs(struct tda_state *state,
                      u8 SubAddr, u8 *Regs, u16 nRegs)
 {
-        u8 data[nRegs+1];
+        u8 data[MAX_XFER_SIZE];
+
+        if (1 + nRegs > sizeof(data)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr: len=%d is too big!\n",
+                       KBUILD_MODNAME, nRegs);
+                return -EINVAL;
+        }
 
         data[0] = SubAddr;
         memcpy(data + 1, Regs, nRegs);
-        return i2c_write(state->i2c, state->adr, data, nRegs+1);
+        return i2c_write(state->i2c, state->adr, data, nRegs + 1);
 }
 
 static int WriteReg(struct tda_state *state, u8 SubAddr, u8 Reg)
diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c
index eff9c5fde50a..91b6b2e9b792 100644
--- a/drivers/media/dvb-frontends/zl10039.c
+++ b/drivers/media/dvb-frontends/zl10039.c
@@ -30,6 +30,9 @@
 
 static int debug;
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 #define dprintk(args...) \
         do { \
                 if (debug) \
@@ -98,7 +101,7 @@ static int zl10039_write(struct zl10039_state *state,
                         const enum zl10039_reg_addr reg, const u8 *src,
                         const size_t count)
 {
-        u8 buf[count + 1];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg = {
                 .addr = state->i2c_addr,
                 .flags = 0,
@@ -106,6 +109,13 @@ static int zl10039_write(struct zl10039_state *state,
                 .len = count + 1,
         };
 
+        if (1 + count > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%zd is too big!\n",
+                       KBUILD_MODNAME, reg, count);
+                return -EINVAL;
+        }
+
         dprintk("%s\n", __func__);
         /* Write register address and data in one go */
         buf[0] = reg;
diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
index ff7232023f56..c1f8cc6f14b2 100644
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -324,23 +324,24 @@ static void cx18_eeprom_dump(struct cx18 *cx, unsigned char *eedata, int len)
 /* Hauppauge card? get values from tveeprom */
 void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
 {
-        struct i2c_client c;
+        struct i2c_client *c;
         u8 eedata[256];
 
-        memset(&c, 0, sizeof(c));
-        strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
-        c.adapter = &cx->i2c_adap[0];
-        c.addr = 0xA0 >> 1;
+        c = kzalloc(sizeof(*c), GFP_KERNEL);
+
+        strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name));
+        c->adapter = &cx->i2c_adap[0];
+        c->addr = 0xa0 >> 1;
 
         memset(tv, 0, sizeof(*tv));
-        if (tveeprom_read(&c, eedata, sizeof(eedata)))
-                return;
+        if (tveeprom_read(c, eedata, sizeof(eedata)))
+                goto ret;
 
         switch (cx->card->type) {
         case CX18_CARD_HVR_1600_ESMT:
         case CX18_CARD_HVR_1600_SAMSUNG:
         case CX18_CARD_HVR_1600_S5H1411:
-                tveeprom_hauppauge_analog(&c, tv, eedata);
+                tveeprom_hauppauge_analog(c, tv, eedata);
                 break;
         case CX18_CARD_YUAN_MPC718:
         case CX18_CARD_GOTVIEW_PCI_DVD3:
@@ -354,6 +355,9 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
                 cx18_eeprom_dump(cx, eedata, sizeof(eedata));
                 break;
         }
+
+ret:
+        kfree(c);
 }
 
 static void cx18_process_eeprom(struct cx18 *cx)
diff --git a/drivers/media/pci/cx23885/cimax2.c b/drivers/media/pci/cx23885/cimax2.c
index 7344849183a7..16fa7ea4d4aa 100644
--- a/drivers/media/pci/cx23885/cimax2.c
+++ b/drivers/media/pci/cx23885/cimax2.c
@@ -26,6 +26,10 @@
 #include "cx23885.h"
 #include "cimax2.h"
 #include "dvb_ca_en50221.h"
+
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /**** Bit definitions for MC417_RWD and MC417_OEN registers  ***
   bits 31-16
 +-----------+
@@ -125,7 +129,7 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
                                                 u8 *buf, int len)
 {
         int ret;
-        u8 buffer[len + 1];
+        u8 buffer[MAX_XFER_SIZE];
 
         struct i2c_msg msg = {
                 .addr   = addr,
@@ -134,6 +138,13 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
                 .len    = len + 1
         };
 
+        if (1 + len > sizeof(buffer)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buffer[0] = reg;
         memcpy(&buffer[1], buf, len);
 
diff --git a/drivers/media/pci/ttpci/av7110_hw.c b/drivers/media/pci/ttpci/av7110_hw.c
index f1cbfe526989..6299d5dadb82 100644
--- a/drivers/media/pci/ttpci/av7110_hw.c
+++ b/drivers/media/pci/ttpci/av7110_hw.c
@@ -22,7 +22,7 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
  *
- * the project's page is at http://www.linuxtv.org/ 
+ * the project's page is at http://www.linuxtv.org/
  */
 
 /* for debugging ARM communication: */
@@ -40,6 +40,14 @@
 
 #define _NOHANDSHAKE
 
+/*
+ * Max transfer size done by av7110_fw_cmd()
+ *
+ * The maximum size passed to this function is 6 bytes. The buffer also
+ * uses two additional ones for type and size. So, 8 bytes is enough.
+ */
+#define MAX_XFER_SIZE  8
+
 /****************************************************************************
  * DEBI functions
  ****************************************************************************/
@@ -488,11 +496,18 @@ static int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
 int av7110_fw_cmd(struct av7110 *av7110, int type, int com, int num, ...)
 {
         va_list args;
-        u16 buf[num + 2];
+        u16 buf[MAX_XFER_SIZE];
         int i, ret;
 
 //      dprintk(4, "%p\n", av7110);
 
+        if (2 + num > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: %s len=%d is too big!\n",
+                       KBUILD_MODNAME, __func__, num);
+                return -EINVAL;
+        }
+
         buf[0] = ((type << 8) | com);
         buf[1] = num;
 
diff --git a/drivers/media/pci/zoran/Kconfig b/drivers/media/pci/zoran/Kconfig
index 26ca8702e33f..39ec35bd21a5 100644
--- a/drivers/media/pci/zoran/Kconfig
+++ b/drivers/media/pci/zoran/Kconfig
@@ -1,6 +1,7 @@
 config VIDEO_ZORAN
         tristate "Zoran ZR36057/36067 Video For Linux"
         depends on PCI && I2C_ALGOBIT && VIDEO_V4L2 && VIRT_TO_BUS
+        depends on !ALPHA
         help
           Say Y for support for MJPEG capture cards based on the Zoran
           36057/36067 PCI controller chipset. This includes the Iomega
diff --git a/drivers/media/platform/soc_camera/rcar_vin.c b/drivers/media/platform/soc_camera/rcar_vin.c
index b21f777f55e7..6866bb4fbebc 100644
--- a/drivers/media/platform/soc_camera/rcar_vin.c
+++ b/drivers/media/platform/soc_camera/rcar_vin.c
@@ -16,6 +16,7 @@
 
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/platform_data/camera-rcar.h>
diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
index b91477212413..3db8a8cfe1a8 100644
--- a/drivers/media/radio/radio-shark.c
+++ b/drivers/media/radio/radio-shark.c
@@ -271,6 +271,7 @@ static void shark_unregister_leds(struct shark_device *shark)
         cancel_work_sync(&shark->led_work);
 }
 
+#ifdef CONFIG_PM
 static void shark_resume_leds(struct shark_device *shark)
 {
         if (test_bit(BLUE_IS_PULSE, &shark->brightness_new))
@@ -280,6 +281,7 @@ static void shark_resume_leds(struct shark_device *shark)
         set_bit(RED_LED, &shark->brightness_new);
         schedule_work(&shark->led_work);
 }
+#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
index 9fb669721e66..d86d90dab8bf 100644
--- a/drivers/media/radio/radio-shark2.c
+++ b/drivers/media/radio/radio-shark2.c
@@ -237,6 +237,7 @@ static void shark_unregister_leds(struct shark_device *shark)
         cancel_work_sync(&shark->led_work);
 }
 
+#ifdef CONFIG_PM
 static void shark_resume_leds(struct shark_device *shark)
 {
         int i;
@@ -246,6 +247,7 @@ static void shark_resume_leds(struct shark_device *shark)
 
         schedule_work(&shark->led_work);
 }
+#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index e5fc9acd0c4f..2a497c80c77f 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -463,7 +463,7 @@ static int si470x_i2c_remove(struct i2c_client *client)
 }
 
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 /*
  * si470x_i2c_suspend - suspend the device
  */
@@ -509,7 +509,7 @@ static struct i2c_driver si470x_i2c_driver = {
         .driver = {
                 .name           = "si470x",
                 .owner          = THIS_MODULE,
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
                 .pm             = &si470x_i2c_pm,
 #endif
         },
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 06ac69245ca1..69e3245a58a0 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -48,15 +48,15 @@
 #define WM_SUB_TEST             0xF
 
 /* Different modes of the MSA register */
-#define MODE_BUFFER             0x0
-#define MODE_PRESET             0x1
-#define MODE_SEARCH             0x2
-#define MODE_AF_UPDATE          0x3
-#define MODE_JUMP               0x4
-#define MODE_CHECK              0x5
-#define MODE_LOAD               0x6
-#define MODE_END                0x7
-#define MODE_SHIFT              5
+#define MSA_MODE_BUFFER         0x0
+#define MSA_MODE_PRESET         0x1
+#define MSA_MODE_SEARCH         0x2
+#define MSA_MODE_AF_UPDATE      0x3
+#define MSA_MODE_JUMP           0x4
+#define MSA_MODE_CHECK          0x5
+#define MSA_MODE_LOAD           0x6
+#define MSA_MODE_END            0x7
+#define MSA_MODE_SHIFT          5
 
 struct tef6862_state {
         struct v4l2_subdev sd;
@@ -114,7 +114,7 @@ static int tef6862_s_frequency(struct v4l2_subdev *sd, const struct v4l2_frequen
 
         clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
         pll = 1964 + ((freq - TEF6862_LO_FREQ) * 20) / FREQ_MUL;
-        i2cmsg[0] = (MODE_PRESET << MODE_SHIFT) | WM_SUB_PLLM;
+        i2cmsg[0] = (MSA_MODE_PRESET << MSA_MODE_SHIFT) | WM_SUB_PLLM;
         i2cmsg[1] = (pll >> 8) & 0xff;
         i2cmsg[2] = pll & 0xff;
 
diff --git a/drivers/media/rc/fintek-cir.h b/drivers/media/rc/fintek-cir.h
index 82516a1d39b0..b698f3d2ced9 100644
--- a/drivers/media/rc/fintek-cir.h
+++ b/drivers/media/rc/fintek-cir.h
@@ -76,8 +76,8 @@ struct fintek_dev {
         } tx;
 
         /* Config register index/data port pair */
-        u8 cr_ip;
-        u8 cr_dp;
+        u32 cr_ip;
+        u32 cr_dp;
 
         /* hardware I/O settings */
         unsigned long cir_addr;
diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index b53626ba6f49..fdae05c4f377 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -308,22 +308,12 @@ static int iguanair_set_tx_carrier(struct rc_dev *dev, uint32_t carrier)
                 cycles = DIV_ROUND_CLOSEST(24000000, carrier * 2) -
                                                         ir->cycle_overhead;
 
-                /*  make up the the remainer of 4-cycle blocks */
-                switch (cycles & 3) {
-                case 0:
-                        sevens = 0;
-                        break;
-                case 1:
-                        sevens = 3;
-                        break;
-                case 2:
-                        sevens = 2;
-                        break;
-                case 3:
-                        sevens = 1;
-                        break;
-                }
-
+                /*
+                 * Calculate minimum number of 7 cycles needed so
+                 * we are left with a multiple of 4; so we want to have
+                 * (sevens * 7) & 3 == cycles & 3
+                 */
+                sevens = (4 - cycles) & 3;
                 fours = (cycles - sevens * 7) / 4;
 
                 /* magic happens here */
diff --git a/drivers/media/rc/nuvoton-cir.h b/drivers/media/rc/nuvoton-cir.h
index 7c3674ff5ea2..07e83108df0f 100644
--- a/drivers/media/rc/nuvoton-cir.h
+++ b/drivers/media/rc/nuvoton-cir.h
@@ -84,8 +84,8 @@ struct nvt_dev {
         } tx;
 
         /* EFER Config register index/data pair */
-        u8 cr_efir;
-        u8 cr_efdr;
+        u32 cr_efir;
+        u32 cr_efdr;
 
         /* hardware I/O settings */
         unsigned long cir_addr;
diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
index 6c96e4898777..72971a8d3c37 100644
--- a/drivers/media/tuners/e4000.c
+++ b/drivers/media/tuners/e4000.c
@@ -21,20 +21,30 @@
 #include "e4000_priv.h"
 #include <linux/math64.h>
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /* write multiple registers */
 static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[1 + len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg->i2c_addr,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
@@ -54,7 +64,7 @@ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
 static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[2] = {
                 {
                         .addr = priv->cfg->i2c_addr,
@@ -64,11 +74,18 @@ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
                 }, {
                         .addr = priv->cfg->i2c_addr,
                         .flags = I2C_M_RD,
-                        .len = sizeof(buf),
+                        .len = len,
                         .buf = buf,
                 }
         };
 
+        if (len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c rd reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, buf, len);
diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
index 81f38aae9c66..3aecaf465094 100644
--- a/drivers/media/tuners/fc2580.c
+++ b/drivers/media/tuners/fc2580.c
@@ -20,6 +20,9 @@
 
 #include "fc2580_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /*
  * TODO:
  * I2C write and read works only for one single register. Multiple registers
@@ -41,16 +44,23 @@
 static int fc2580_wr_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[1 + len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg->i2c_addr,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
@@ -69,7 +79,7 @@ static int fc2580_wr_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
 static int fc2580_rd_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[2] = {
                 {
                         .addr = priv->cfg->i2c_addr,
@@ -79,11 +89,18 @@ static int fc2580_rd_regs(struct fc2580_priv *priv, u8 reg, u8 *val, int len)
                 }, {
                         .addr = priv->cfg->i2c_addr,
                         .flags = I2C_M_RD,
-                        .len = sizeof(buf),
+                        .len = len,
                         .buf = buf,
                 }
         };
 
+        if (len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c rd reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, buf, len);
diff --git a/drivers/media/tuners/tda18212.c b/drivers/media/tuners/tda18212.c
index e4a84ee231cf..abe256e1f843 100644
--- a/drivers/media/tuners/tda18212.c
+++ b/drivers/media/tuners/tda18212.c
@@ -20,6 +20,9 @@
 
 #include "tda18212.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 struct tda18212_priv {
         struct tda18212_config *cfg;
         struct i2c_adapter *i2c;
@@ -32,16 +35,23 @@ static int tda18212_wr_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
         int len)
 {
         int ret;
-        u8 buf[len+1];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg->i2c_address,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
@@ -61,7 +71,7 @@ static int tda18212_rd_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
         int len)
 {
         int ret;
-        u8 buf[len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[2] = {
                 {
                         .addr = priv->cfg->i2c_address,
@@ -71,11 +81,18 @@ static int tda18212_rd_regs(struct tda18212_priv *priv, u8 reg, u8 *val,
                 }, {
                         .addr = priv->cfg->i2c_address,
                         .flags = I2C_M_RD,
-                        .len = sizeof(buf),
+                        .len = len,
                         .buf = buf,
                 }
         };
 
+        if (len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c rd reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, buf, len);
diff --git a/drivers/media/tuners/tda18218.c b/drivers/media/tuners/tda18218.c
index 2d31aeb6b088..9300e9361e3b 100644
--- a/drivers/media/tuners/tda18218.c
+++ b/drivers/media/tuners/tda18218.c
@@ -20,11 +20,14 @@
 
 #include "tda18218_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /* write multiple registers */
 static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
 {
         int ret = 0, len2, remaining;
-        u8 buf[1 + len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg->i2c_address,
@@ -33,6 +36,13 @@ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         for (remaining = len; remaining > 0;
                         remaining -= (priv->cfg->i2c_wr_max - 1)) {
                 len2 = remaining;
@@ -63,7 +73,7 @@ static int tda18218_wr_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
 static int tda18218_rd_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
 {
         int ret;
-        u8 buf[reg+len]; /* we must start read always from reg 0x00 */
+        u8 buf[MAX_XFER_SIZE]; /* we must start read always from reg 0x00 */
         struct i2c_msg msg[2] = {
                 {
                         .addr = priv->cfg->i2c_address,
@@ -73,11 +83,18 @@ static int tda18218_rd_regs(struct tda18218_priv *priv, u8 reg, u8 *val, u8 len)
                 }, {
                         .addr = priv->cfg->i2c_address,
                         .flags = I2C_M_RD,
-                        .len = sizeof(buf),
+                        .len = reg + len,
                         .buf = buf,
                 }
         };
 
+        if (reg + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, &buf[reg], len);
diff --git a/drivers/media/tuners/tda9887.c b/drivers/media/tuners/tda9887.c
index 300005c535ba..9823248d743f 100644
--- a/drivers/media/tuners/tda9887.c
+++ b/drivers/media/tuners/tda9887.c
@@ -536,8 +536,8 @@ static int tda9887_status(struct dvb_frontend *fe)
         unsigned char buf[1];
         int rc;
 
-        memset(buf,0,sizeof(buf));
-        if (1 != (rc = tuner_i2c_xfer_recv(&priv->i2c_props,buf,1)))
+        rc = tuner_i2c_xfer_recv(&priv->i2c_props, buf, 1);
+        if (rc != 1)
                 tuner_info("i2c i/o error: rc == %d (should be 1)\n", rc);
         dump_read_message(fe, buf);
         return 0;
diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
index e287a7417319..4be5cf808a40 100644
--- a/drivers/media/tuners/tuner-xc2028.c
+++ b/drivers/media/tuners/tuner-xc2028.c
@@ -24,6 +24,9 @@
 #include <linux/dvb/frontend.h>
 #include "dvb_frontend.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  80
+
 /* Registers (Write-only) */
 #define XREG_INIT         0x00
 #define XREG_RF_FREQ      0x02
@@ -547,7 +550,10 @@ static int load_firmware(struct dvb_frontend *fe, unsigned int type,
 {
         struct xc2028_data *priv = fe->tuner_priv;
         int                pos, rc;
-        unsigned char      *p, *endp, buf[priv->ctrl.max_len];
+        unsigned char      *p, *endp, buf[MAX_XFER_SIZE];
+
+        if (priv->ctrl.max_len > sizeof(buf))
+                priv->ctrl.max_len = sizeof(buf);
 
         tuner_dbg("%s called\n", __func__);
 
diff --git a/drivers/media/usb/dvb-usb-v2/af9015.c b/drivers/media/usb/dvb-usb-v2/af9015.c
index d556042cf312..da47d2392f2a 100644
--- a/drivers/media/usb/dvb-usb-v2/af9015.c
+++ b/drivers/media/usb/dvb-usb-v2/af9015.c
@@ -397,12 +397,13 @@ error:
         return ret;
 }
 
+#define AF9015_EEPROM_SIZE 256
+
 /* hash (and dump) eeprom */
 static int af9015_eeprom_hash(struct dvb_usb_device *d)
 {
         struct af9015_state *state = d_to_priv(d);
         int ret, i;
-        static const unsigned int AF9015_EEPROM_SIZE = 256;
         u8 buf[AF9015_EEPROM_SIZE];
         struct req_t req = {READ_I2C, AF9015_I2C_EEPROM, 0, 0, 1, 1, NULL};
 
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 1ea17dc2a76e..c8fcd78425bd 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -21,6 +21,9 @@
 
 #include "af9035.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
 static u16 af9035_checksum(const u8 *buf, size_t len)
@@ -126,10 +129,16 @@ exit:
 /* write multiple registers */
 static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
 {
-        u8 wbuf[6 + len];
+        u8 wbuf[MAX_XFER_SIZE];
         u8 mbox = (reg >> 16) & 0xff;
         struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
 
+        if (6 + len > sizeof(wbuf)) {
+                dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
+                         KBUILD_MODNAME, len);
+                return -EOPNOTSUPP;
+        }
+
         wbuf[0] = len;
         wbuf[1] = 2;
         wbuf[2] = 0;
@@ -228,9 +237,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                                         msg[1].len);
                 } else {
                         /* I2C */
-                        u8 buf[5 + msg[0].len];
+                        u8 buf[MAX_XFER_SIZE];
                         struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
                                         buf, msg[1].len, msg[1].buf };
+
+                        if (5 + msg[0].len > sizeof(buf)) {
+                                dev_warn(&d->udev->dev,
+                                         "%s: i2c xfer: len=%d is too big!\n",
+                                         KBUILD_MODNAME, msg[0].len);
+                                return -EOPNOTSUPP;
+                        }
                         req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                         buf[0] = msg[1].len;
                         buf[1] = msg[0].addr << 1;
@@ -257,9 +273,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                                         msg[0].len - 3);
                 } else {
                         /* I2C */
-                        u8 buf[5 + msg[0].len];
+                        u8 buf[MAX_XFER_SIZE];
                         struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
                                         0, NULL };
+
+                        if (5 + msg[0].len > sizeof(buf)) {
+                                dev_warn(&d->udev->dev,
+                                         "%s: i2c xfer: len=%d is too big!\n",
+                                         KBUILD_MODNAME, msg[0].len);
+                                return -EOPNOTSUPP;
+                        }
                         req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                         buf[0] = msg[0].len;
                         buf[1] = msg[0].addr << 1;
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index e97964ef7f56..2627553f7de1 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -23,6 +23,9 @@
 #include "lgdt3305.h"
 #include "lg2160.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 int dvb_usb_mxl111sf_debug;
 module_param_named(debug, dvb_usb_mxl111sf_debug, int, 0644);
 MODULE_PARM_DESC(debug, "set debugging level "
@@ -57,7 +60,12 @@ int mxl111sf_ctrl_msg(struct dvb_usb_device *d,
 {
         int wo = (rbuf == NULL || rlen == 0); /* write-only */
         int ret;
-        u8 sndbuf[1+wlen];
+        u8 sndbuf[MAX_XFER_SIZE];
+
+        if (1 + wlen > sizeof(sndbuf)) {
+                pr_warn("%s: len=%d is too big!\n", __func__, wlen);
+                return -EOPNOTSUPP;
+        }
 
         pr_debug("%s(wlen = %d, rlen = %d)\n", __func__, wlen, rlen);
 
diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 3940bb0f9ef6..20e345d9fe8f 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -43,6 +43,9 @@
 #include "lgs8gxx.h"
 #include "atbm8830.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /* debug */
 static int dvb_usb_cxusb_debug;
 module_param_named(debug, dvb_usb_cxusb_debug, int, 0644);
@@ -57,7 +60,14 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
                           u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
         int wo = (rbuf == NULL || rlen == 0); /* write-only */
-        u8 sndbuf[1+wlen];
+        u8 sndbuf[MAX_XFER_SIZE];
+
+        if (1 + wlen > sizeof(sndbuf)) {
+                warn("i2c wr: len=%d is too big!\n",
+                     wlen);
+                return -EOPNOTSUPP;
+        }
+
         memset(sndbuf, 0, 1+wlen);
 
         sndbuf[0] = cmd;
@@ -158,7 +168,13 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 
                 if (msg[i].flags & I2C_M_RD) {
                         /* read only */
-                        u8 obuf[3], ibuf[1+msg[i].len];
+                        u8 obuf[3], ibuf[MAX_XFER_SIZE];
+
+                        if (1 + msg[i].len > sizeof(ibuf)) {
+                                warn("i2c rd: len=%d is too big!\n",
+                                     msg[i].len);
+                                return -EOPNOTSUPP;
+                        }
                         obuf[0] = 0;
                         obuf[1] = msg[i].len;
                         obuf[2] = msg[i].addr;
@@ -172,7 +188,18 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                 } else if (i+1 < num && (msg[i+1].flags & I2C_M_RD) &&
                            msg[i].addr == msg[i+1].addr) {
                         /* write to then read from same address */
-                        u8 obuf[3+msg[i].len], ibuf[1+msg[i+1].len];
+                        u8 obuf[MAX_XFER_SIZE], ibuf[MAX_XFER_SIZE];
+
+                        if (3 + msg[i].len > sizeof(obuf)) {
+                                warn("i2c wr: len=%d is too big!\n",
+                                     msg[i].len);
+                                return -EOPNOTSUPP;
+                        }
+                        if (1 + msg[i + 1].len > sizeof(ibuf)) {
+                                warn("i2c rd: len=%d is too big!\n",
+                                     msg[i + 1].len);
+                                return -EOPNOTSUPP;
+                        }
                         obuf[0] = msg[i].len;
                         obuf[1] = msg[i+1].len;
                         obuf[2] = msg[i].addr;
@@ -191,7 +218,13 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                         i++;
                 } else {
                         /* write only */
-                        u8 obuf[2+msg[i].len], ibuf;
+                        u8 obuf[MAX_XFER_SIZE], ibuf;
+
+                        if (2 + msg[i].len > sizeof(obuf)) {
+                                warn("i2c wr: len=%d is too big!\n",
+                                     msg[i].len);
+                                return -EOPNOTSUPP;
+                        }
                         obuf[0] = msg[i].addr;
                         obuf[1] = msg[i].len;
                         memcpy(&obuf[2], msg[i].buf, msg[i].len);
diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
index c2dded92f1d3..6d68af0c49c8 100644
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -12,6 +12,9 @@
 #include <linux/kconfig.h>
 #include "dibusb.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static int debug;
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "set debugging level (1=info (|-able))." DVB_USB_DEBUG_STATUS);
@@ -105,11 +108,16 @@ EXPORT_SYMBOL(dibusb2_0_power_ctrl);
 static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr,
                           u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
 {
-        u8 sndbuf[wlen+4]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
+        u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
         /* write only ? */
         int wo = (rbuf == NULL || rlen == 0),
                 len = 2 + wlen + (wo ? 0 : 2);
 
+        if (4 + wlen > sizeof(sndbuf)) {
+                warn("i2c wr: len=%d is too big!\n", wlen);
+                return -EOPNOTSUPP;
+        }
+
         sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ;
         sndbuf[1] = (addr << 1) | (wo ? 0 : 1);
 
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 6136a2c7dbfd..c1a63b2a6baa 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -30,6 +30,9 @@
 #include "stb6100_proc.h"
 #include "m88rs2000.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 #ifndef USB_PID_DW2102
 #define USB_PID_DW2102 0x2102
 #endif
@@ -308,7 +311,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
         case 2: {
                 /* read */
                 /* first write first register number */
-                u8 ibuf[msg[1].len + 2], obuf[3];
+                u8 ibuf[MAX_XFER_SIZE], obuf[3];
+
+                if (2 + msg[1].len > sizeof(ibuf)) {
+                        warn("i2c rd: len=%d is too big!\n",
+                             msg[1].len);
+                        return -EOPNOTSUPP;
+                }
+
                 obuf[0] = msg[0].addr << 1;
                 obuf[1] = msg[0].len;
                 obuf[2] = msg[0].buf[0];
@@ -325,7 +335,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
                 switch (msg[0].addr) {
                 case 0x68: {
                         /* write to register */
-                        u8 obuf[msg[0].len + 2];
+                        u8 obuf[MAX_XFER_SIZE];
+
+                        if (2 + msg[0].len > sizeof(obuf)) {
+                                warn("i2c wr: len=%d is too big!\n",
+                                     msg[1].len);
+                                return -EOPNOTSUPP;
+                        }
+
                         obuf[0] = msg[0].addr << 1;
                         obuf[1] = msg[0].len;
                         memcpy(obuf + 2, msg[0].buf, msg[0].len);
@@ -335,7 +352,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
                 }
                 case 0x61: {
                         /* write to tuner */
-                        u8 obuf[msg[0].len + 2];
+                        u8 obuf[MAX_XFER_SIZE];
+
+                        if (2 + msg[0].len > sizeof(obuf)) {
+                                warn("i2c wr: len=%d is too big!\n",
+                                     msg[1].len);
+                                return -EOPNOTSUPP;
+                        }
+
                         obuf[0] = msg[0].addr << 1;
                         obuf[1] = msg[0].len;
                         memcpy(obuf + 2, msg[0].buf, msg[0].len);
@@ -401,7 +425,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
                 default: {
                         if (msg[j].flags == I2C_M_RD) {
                                 /* read registers */
-                                u8  ibuf[msg[j].len + 2];
+                                u8  ibuf[MAX_XFER_SIZE];
+
+                                if (2 + msg[j].len > sizeof(ibuf)) {
+                                        warn("i2c rd: len=%d is too big!\n",
+                                             msg[j].len);
+                                        return -EOPNOTSUPP;
+                                }
+
                                 dw210x_op_rw(d->udev, 0xc3,
                                                 (msg[j].addr << 1) + 1, 0,
                                                 ibuf, msg[j].len + 2,
@@ -430,7 +461,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
                                 } while (len > 0);
                         } else {
                                 /* write registers */
-                                u8 obuf[msg[j].len + 2];
+                                u8 obuf[MAX_XFER_SIZE];
+
+                                if (2 + msg[j].len > sizeof(obuf)) {
+                                        warn("i2c wr: len=%d is too big!\n",
+                                             msg[j].len);
+                                        return -EOPNOTSUPP;
+                                }
+
                                 obuf[0] = msg[j].addr << 1;
                                 obuf[1] = msg[j].len;
                                 memcpy(obuf + 2, msg[j].buf, msg[j].len);
@@ -463,7 +501,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
         case 2: {
                 /* read */
                 /* first write first register number */
-                u8 ibuf[msg[1].len + 2], obuf[3];
+                u8 ibuf[MAX_XFER_SIZE], obuf[3];
+
+                if (2 + msg[1].len > sizeof(ibuf)) {
+                        warn("i2c rd: len=%d is too big!\n",
+                             msg[1].len);
+                        return -EOPNOTSUPP;
+                }
                 obuf[0] = msg[0].addr << 1;
                 obuf[1] = msg[0].len;
                 obuf[2] = msg[0].buf[0];
@@ -481,7 +525,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                 case 0x60:
                 case 0x0c: {
                         /* write to register */
-                        u8 obuf[msg[0].len + 2];
+                        u8 obuf[MAX_XFER_SIZE];
+
+                        if (2 + msg[0].len > sizeof(obuf)) {
+                                warn("i2c wr: len=%d is too big!\n",
+                                     msg[0].len);
+                                return -EOPNOTSUPP;
+                        }
                         obuf[0] = msg[0].addr << 1;
                         obuf[1] = msg[0].len;
                         memcpy(obuf + 2, msg[0].buf, msg[0].len);
@@ -563,7 +613,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                 default: {
                         if (msg[j].flags == I2C_M_RD) {
                                 /* read registers */
-                                u8 ibuf[msg[j].len];
+                                u8 ibuf[MAX_XFER_SIZE];
+
+                                if (msg[j].len > sizeof(ibuf)) {
+                                        warn("i2c rd: len=%d is too big!\n",
+                                             msg[j].len);
+                                        return -EOPNOTSUPP;
+                                }
+
                                 dw210x_op_rw(d->udev, 0x91, 0, 0,
                                                 ibuf, msg[j].len,
                                                 DW210X_READ_MSG);
@@ -590,7 +647,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                 } while (len > 0);
                         } else if (j < (num - 1)) {
                                 /* write register addr before read */
-                                u8 obuf[msg[j].len + 2];
+                                u8 obuf[MAX_XFER_SIZE];
+
+                                if (2 + msg[j].len > sizeof(obuf)) {
+                                        warn("i2c wr: len=%d is too big!\n",
+                                             msg[j].len);
+                                        return -EOPNOTSUPP;
+                                }
+
                                 obuf[0] = msg[j + 1].len;
                                 obuf[1] = (msg[j].addr << 1);
                                 memcpy(obuf + 2, msg[j].buf, msg[j].len);
@@ -602,7 +666,13 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                 break;
                         } else {
                                 /* write registers */
-                                u8 obuf[msg[j].len + 2];
+                                u8 obuf[MAX_XFER_SIZE];
+
+                                if (2 + msg[j].len > sizeof(obuf)) {
+                                        warn("i2c wr: len=%d is too big!\n",
+                                             msg[j].len);
+                                        return -EOPNOTSUPP;
+                                }
                                 obuf[0] = msg[j].len + 1;
                                 obuf[1] = (msg[j].addr << 1);
                                 memcpy(obuf + 2, msg[j].buf, msg[j].len);
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 3394c3432011..899cb6d1c4a4 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -680,7 +680,8 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
                   stream->dev->name,
                   sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
                   y, ts.tv_sec, ts.tv_nsec / NSEC_PER_USEC,
-                  v4l2_buf->timestamp.tv_sec, v4l2_buf->timestamp.tv_usec,
+                  v4l2_buf->timestamp.tv_sec,
+                  (unsigned long)v4l2_buf->timestamp.tv_usec,
                   x1, first->host_sof, first->dev_sof,
                   x2, last->host_sof, last->dev_sof, y1, y2);
 
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index c85d69da35bd..85a6a34128a8 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -189,30 +189,53 @@ void v4l2_async_notifier_unregister(struct v4l2_async_notifier *notifier)
         struct v4l2_subdev *sd, *tmp;
         unsigned int notif_n_subdev = notifier->num_subdevs;
         unsigned int n_subdev = min(notif_n_subdev, V4L2_MAX_SUBDEVS);
-        struct device *dev[n_subdev];
+        struct device **dev;
         int i = 0;
 
         if (!notifier->v4l2_dev)
                 return;
 
+        dev = kmalloc(n_subdev * sizeof(*dev), GFP_KERNEL);
+        if (!dev) {
+                dev_err(notifier->v4l2_dev->dev,
+                        "Failed to allocate device cache!\n");
+        }
+
         mutex_lock(&list_lock);
 
         list_del(&notifier->list);
 
         list_for_each_entry_safe(sd, tmp, &notifier->done, async_list) {
-                dev[i] = get_device(sd->dev);
+                struct device *d;
+
+                d = get_device(sd->dev);
 
                 v4l2_async_cleanup(sd);
 
                 /* If we handled USB devices, we'd have to lock the parent too */
-                device_release_driver(dev[i++]);
+                device_release_driver(d);
 
                 if (notifier->unbind)
                         notifier->unbind(notifier, sd, sd->asd);
+
+                /*
+                 * Store device at the device cache, in order to call
+                 * put_device() on the final step
+                 */
+                if (dev)
+                        dev[i++] = d;
+                else
+                        put_device(d);
         }
 
         mutex_unlock(&list_lock);
 
+        /*
+         * Call device_attach() to reprobe devices
+         *
+         * NOTE: If dev allocation fails, i is 0, and the whole loop won't be
+         * executed.
+         */
         while (i--) {
                 struct device *d = dev[i];
 
@@ -228,6 +251,7 @@ void v4l2_async_notifier_unregister(struct v4l2_async_notifier *notifier)
                 }
                 put_device(d);
         }
+        kfree(dev);
 
         notifier->v4l2_dev = NULL;
 
diff --git a/drivers/staging/media/lirc/lirc_serial.c b/drivers/staging/media/lirc/lirc_serial.c
index f6bc4c91ab35..2e3a98575d47 100644
--- a/drivers/staging/media/lirc/lirc_serial.c
+++ b/drivers/staging/media/lirc/lirc_serial.c
@@ -707,7 +707,8 @@ static irqreturn_t irq_handler(int i, void *blah)
                                 pr_warn("ignoring spike: %d %d %lx %lx %lx %lx\n",
                                         dcd, sense,
                                         tv.tv_sec, lasttv.tv_sec,
-                                        tv.tv_usec, lasttv.tv_usec);
+                                        (unsigned long)tv.tv_usec,
+                                        (unsigned long)lasttv.tv_usec);
                                 continue;
                         }
 
@@ -719,7 +720,8 @@ static irqreturn_t irq_handler(int i, void *blah)
                                 pr_warn("%d %d %lx %lx %lx %lx\n",
                                         dcd, sense,
                                         tv.tv_sec, lasttv.tv_sec,
-                                        tv.tv_usec, lasttv.tv_usec);
+                                        (unsigned long)tv.tv_usec,
+                                        (unsigned long)lasttv.tv_usec);
                                 data = PULSE_MASK;
                         } else if (deltv > 15) {
                                 data = PULSE_MASK; /* really long time */
@@ -728,7 +730,8 @@ static irqreturn_t irq_handler(int i, void *blah)
                                         pr_warn("AIEEEE: %d %d %lx %lx %lx %lx\n",
                                                 dcd, sense,
                                                 tv.tv_sec, lasttv.tv_sec,
-                                                tv.tv_usec, lasttv.tv_usec);
+                                                (unsigned long)tv.tv_usec,
+                                                (unsigned long)lasttv.tv_usec);
                                         /*
                                          * detecting pulse while this
                                          * MUST be a space!
diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c
index 11d5338b4f2f..0feeaadf29dc 100644
--- a/drivers/staging/media/lirc/lirc_zilog.c
+++ b/drivers/staging/media/lirc/lirc_zilog.c
@@ -61,6 +61,9 @@
 #include <media/lirc_dev.h>
 #include <media/lirc.h>
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 struct IR;
 
 struct IR_rx {
@@ -941,7 +944,14 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
                         schedule();
                         set_current_state(TASK_INTERRUPTIBLE);
                 } else {
-                        unsigned char buf[rbuf->chunk_size];
+                        unsigned char buf[MAX_XFER_SIZE];
+
+                        if (rbuf->chunk_size > sizeof(buf)) {
+                                zilog_error("chunk_size is too big (%d)!\n",
+                                            rbuf->chunk_size);
+                                ret = -EINVAL;
+                                break;
+                        }
                         m = lirc_buffer_read(rbuf, buf);
                         if (m == rbuf->chunk_size) {
                                 ret = copy_to_user((void *)outbuf+written, buf,