Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media build fixes from Mauro Carvalho Chehab:
 "A series of patches that fix compilation on non-x86 archs.

  While most of them are just build fixes, there are some fixes for real
  bugs, as there are a number of drivers using dynamic stack allocation.
  A few of those might be considered a security risk, if the i2c-dev
  module is loaded, as someone could be sending very long I2C data that
  could potentially overflow the Kernel stack.  Ok, as using /dev/i2c-*
  devnodes usually requires root on usual distros, and exploiting it
  would require a DVB board or USB stick, the risk is not high"

* 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits)
  [media] platform drivers: Fix build on frv arch
  [media] lirc_zilog: Don't use dynamic static allocation
  [media] mxl111sf: Don't use dynamic static allocation
  [media] af9035: Don't use dynamic static allocation
  [media] af9015: Don't use dynamic static allocation
  [media] dw2102: Don't use dynamic static allocation
  [media] dibusb-common: Don't use dynamic static allocation
  [media] cxusb: Don't use dynamic static allocation
  [media] v4l2-async: Don't use dynamic static allocation
  [media] cimax2: Don't use dynamic static allocation
  [media] tuner-xc2028: Don't use dynamic static allocation
  [media] tuners: Don't use dynamic static allocation
  [media] av7110_hw: Don't use dynamic static allocation
  [media] stv090x: Don't use dynamic static allocation
  [media] stv0367: Don't use dynamic static allocation
  [media] stb0899_drv: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] s5h1420: Don't use dynamic static allocation
  [media] uvc/lirc_serial: Fix some warnings on parisc arch
  ...

1 files changed, 21 insertions, 4 deletions

diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
index 6c96e4898777..72971a8d3c37 100644
--- a/drivers/media/tuners/e4000.c
+++ b/drivers/media/tuners/e4000.c
@@ -21,20 +21,30 @@
 #include "e4000_priv.h"
 #include <linux/math64.h>
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /* write multiple registers */
 static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[1 + len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[1] = {
                 {
                         .addr = priv->cfg->i2c_addr,
                         .flags = 0,
-                        .len = sizeof(buf),
+                        .len = 1 + len,
                         .buf = buf,
                 }
         };
 
+        if (1 + len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         buf[0] = reg;
         memcpy(&buf[1], val, len);
 
@@ -54,7 +64,7 @@ static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
 static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
 {
         int ret;
-        u8 buf[len];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg[2] = {
                 {
                         .addr = priv->cfg->i2c_addr,
@@ -64,11 +74,18 @@ static int e4000_rd_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
                 }, {
                         .addr = priv->cfg->i2c_addr,
                         .flags = I2C_M_RD,
-                        .len = sizeof(buf),
+                        .len = len,
                         .buf = buf,
                 }
         };
 
+        if (len > sizeof(buf)) {
+                dev_warn(&priv->i2c->dev,
+                         "%s: i2c rd reg=%04x: len=%d is too big!\n",
+                         KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
         ret = i2c_transfer(priv->i2c, msg, 2);
         if (ret == 2) {
                 memcpy(val, buf, len);