2 files changed, 10 insertions, 0 deletions

diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 7490dc1771ae..573abe440842 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -334,6 +334,10 @@ static int __devinit amd756_probe(struct pci_dev *pdev,
         int error;
         u8 temp;
         
+        /* driver_data might come from user-space, so check it */
+        if (id->driver_data > ARRAY_SIZE(chipname))
+                return -EINVAL;
+
         if (amd756_ioport) {
                 dev_err(&pdev->dev, "Only one device supported "
                        "(you have a strange motherboard, btw)\n");
@@ -405,6 +409,7 @@ static struct pci_driver amd756_driver = {
         .id_table       = amd756_ids,
         .probe          = amd756_probe,
         .remove         = __devexit_p(amd756_remove),
+        .dynids.use_driver_data = 1,
 };
 
 static int __init amd756_init(void)
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index c9ce77f13c0e..661ebc7a711e 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -318,6 +318,10 @@ static int __devinit vt596_probe(struct pci_dev *pdev,
         unsigned char temp;
         int error = -ENODEV;
 
+        /* driver_data might come from user-space, so check it */
+        if (id->driver_data & 1 || id->driver_data > 0xff)
+                return -EINVAL;
+
         /* Determine the address of the SMBus areas */
         if (force_addr) {
                 vt596_smba = force_addr & 0xfff0;
@@ -455,6 +459,7 @@ static struct pci_driver vt596_driver = {
         .name           = "vt596_smbus",
         .id_table       = vt596_ids,
         .probe          = vt596_probe,
+        .dynids.use_driver_data = 1,
 };
 
 static int __init i2c_vt596_init(void)