Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media build fixes from Mauro Carvalho Chehab:
 "A series of patches that fix compilation on non-x86 archs.

  While most of them are just build fixes, there are some fixes for real
  bugs, as there are a number of drivers using dynamic stack allocation.
  A few of those might be considered a security risk, if the i2c-dev
  module is loaded, as someone could be sending very long I2C data that
  could potentially overflow the Kernel stack.  Ok, as using /dev/i2c-*
  devnodes usually requires root on usual distros, and exploiting it
  would require a DVB board or USB stick, the risk is not high"

* 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits)
  [media] platform drivers: Fix build on frv arch
  [media] lirc_zilog: Don't use dynamic static allocation
  [media] mxl111sf: Don't use dynamic static allocation
  [media] af9035: Don't use dynamic static allocation
  [media] af9015: Don't use dynamic static allocation
  [media] dw2102: Don't use dynamic static allocation
  [media] dibusb-common: Don't use dynamic static allocation
  [media] cxusb: Don't use dynamic static allocation
  [media] v4l2-async: Don't use dynamic static allocation
  [media] cimax2: Don't use dynamic static allocation
  [media] tuner-xc2028: Don't use dynamic static allocation
  [media] tuners: Don't use dynamic static allocation
  [media] av7110_hw: Don't use dynamic static allocation
  [media] stv090x: Don't use dynamic static allocation
  [media] stv0367: Don't use dynamic static allocation
  [media] stb0899_drv: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] s5h1420: Don't use dynamic static allocation
  [media] uvc/lirc_serial: Fix some warnings on parisc arch
  ...

4 files changed, 42 insertions, 11 deletions

diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
index ff7232023f56..c1f8cc6f14b2 100644
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -324,23 +324,24 @@ static void cx18_eeprom_dump(struct cx18 *cx, unsigned char *eedata, int len)
 /* Hauppauge card? get values from tveeprom */
 void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
 {
-        struct i2c_client c;
+        struct i2c_client *c;
         u8 eedata[256];
 
-        memset(&c, 0, sizeof(c));
-        strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
-        c.adapter = &cx->i2c_adap[0];
-        c.addr = 0xA0 >> 1;
+        c = kzalloc(sizeof(*c), GFP_KERNEL);
+
+        strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name));
+        c->adapter = &cx->i2c_adap[0];
+        c->addr = 0xa0 >> 1;
 
         memset(tv, 0, sizeof(*tv));
-        if (tveeprom_read(&c, eedata, sizeof(eedata)))
-                return;
+        if (tveeprom_read(c, eedata, sizeof(eedata)))
+                goto ret;
 
         switch (cx->card->type) {
         case CX18_CARD_HVR_1600_ESMT:
         case CX18_CARD_HVR_1600_SAMSUNG:
         case CX18_CARD_HVR_1600_S5H1411:
-                tveeprom_hauppauge_analog(&c, tv, eedata);
+                tveeprom_hauppauge_analog(c, tv, eedata);
                 break;
         case CX18_CARD_YUAN_MPC718:
         case CX18_CARD_GOTVIEW_PCI_DVD3:
@@ -354,6 +355,9 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
                 cx18_eeprom_dump(cx, eedata, sizeof(eedata));
                 break;
         }
+
+ret:
+        kfree(c);
 }
 
 static void cx18_process_eeprom(struct cx18 *cx)
diff --git a/drivers/media/pci/cx23885/cimax2.c b/drivers/media/pci/cx23885/cimax2.c
index 7344849183a7..16fa7ea4d4aa 100644
--- a/drivers/media/pci/cx23885/cimax2.c
+++ b/drivers/media/pci/cx23885/cimax2.c
@@ -26,6 +26,10 @@
 #include "cx23885.h"
 #include "cimax2.h"
 #include "dvb_ca_en50221.h"
+
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /**** Bit definitions for MC417_RWD and MC417_OEN registers  ***
   bits 31-16
 +-----------+
@@ -125,7 +129,7 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
                                                 u8 *buf, int len)
 {
         int ret;
-        u8 buffer[len + 1];
+        u8 buffer[MAX_XFER_SIZE];
 
         struct i2c_msg msg = {
                 .addr   = addr,
@@ -134,6 +138,13 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
                 .len    = len + 1
         };
 
+        if (1 + len > sizeof(buffer)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buffer[0] = reg;
         memcpy(&buffer[1], buf, len);
 
diff --git a/drivers/media/pci/ttpci/av7110_hw.c b/drivers/media/pci/ttpci/av7110_hw.c
index f1cbfe526989..6299d5dadb82 100644
--- a/drivers/media/pci/ttpci/av7110_hw.c
+++ b/drivers/media/pci/ttpci/av7110_hw.c
@@ -22,7 +22,7 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
  *
- * the project's page is at http://www.linuxtv.org/ 
+ * the project's page is at http://www.linuxtv.org/
  */
 
 /* for debugging ARM communication: */
@@ -40,6 +40,14 @@
 
 #define _NOHANDSHAKE
 
+/*
+ * Max transfer size done by av7110_fw_cmd()
+ *
+ * The maximum size passed to this function is 6 bytes. The buffer also
+ * uses two additional ones for type and size. So, 8 bytes is enough.
+ */
+#define MAX_XFER_SIZE  8
+
 /****************************************************************************
  * DEBI functions
  ****************************************************************************/
@@ -488,11 +496,18 @@ static int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
 int av7110_fw_cmd(struct av7110 *av7110, int type, int com, int num, ...)
 {
         va_list args;
-        u16 buf[num + 2];
+        u16 buf[MAX_XFER_SIZE];
         int i, ret;
 
 //      dprintk(4, "%p\n", av7110);
 
+        if (2 + num > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: %s len=%d is too big!\n",
+                       KBUILD_MODNAME, __func__, num);
+                return -EINVAL;
+        }
+
         buf[0] = ((type << 8) | com);
         buf[1] = num;
 
diff --git a/drivers/media/pci/zoran/Kconfig b/drivers/media/pci/zoran/Kconfig
index 26ca8702e33f..39ec35bd21a5 100644
--- a/drivers/media/pci/zoran/Kconfig
+++ b/drivers/media/pci/zoran/Kconfig
@@ -1,6 +1,7 @@
 config VIDEO_ZORAN
         tristate "Zoran ZR36057/36067 Video For Linux"
         depends on PCI && I2C_ALGOBIT && VIDEO_V4L2 && VIRT_TO_BUS
+        depends on !ALPHA
         help
           Say Y for support for MJPEG capture cards based on the Zoran
           36057/36067 PCI controller chipset. This includes the Iomega