1 files changed, 19 insertions, 4 deletions

diff --git a/drivers/media/dvb/dvb-usb/friio.c b/drivers/media/dvb/dvb-usb/friio.c
index 14a65b4aec07..76159aed9bb0 100644
--- a/drivers/media/dvb/dvb-usb/friio.c
+++ b/drivers/media/dvb/dvb-usb/friio.c
@@ -142,17 +142,20 @@ static u32 gl861_i2c_func(struct i2c_adapter *adapter)
         return I2C_FUNC_I2C;
 }
 
-
 static int friio_ext_ctl(struct dvb_usb_adapter *adap,
                          u32 sat_color, int lnb_on)
 {
         int i;
         int ret;
         struct i2c_msg msg;
-        u8 buf[2];
+        u8 *buf;
         u32 mask;
         u8 lnb = (lnb_on) ? FRIIO_CTL_LNB : 0;
 
+        buf = kmalloc(2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
         msg.addr = 0x00;
         msg.flags = 0;
         msg.len = 2;
@@ -189,6 +192,7 @@ static int friio_ext_ctl(struct dvb_usb_adapter *adap,
         buf[1] |= FRIIO_CTL_CLK;
         ret += gl861_i2c_xfer(&adap->dev->i2c_adap, &msg, 1);
 
+        kfree(buf);
         return (ret == 70);
 }
 
@@ -219,11 +223,20 @@ static int friio_initialize(struct dvb_usb_device *d)
         int ret;
         int i;
         int retry = 0;
-        u8 rbuf[2];
-        u8 wbuf[3];
+        u8 *rbuf, *wbuf;
 
         deb_info("%s called.\n", __func__);
 
+        wbuf = kmalloc(3, GFP_KERNEL);
+        if (!wbuf)
+                return -ENOMEM;
+
+        rbuf = kmalloc(2, GFP_KERNEL);
+        if (!rbuf) {
+                kfree(wbuf);
+                return -ENOMEM;
+        }
+
         /* use gl861_i2c_msg instead of gl861_i2c_xfer(), */
         /* because the i2c device is not set up yet. */
         wbuf[0] = 0x11;
@@ -358,6 +371,8 @@ restart:
         return 0;
 
 error:
+        kfree(wbuf);
+        kfree(rbuf);
         deb_info("%s:ret == %d\n", __func__, ret);
         return -EIO;
 }