1 files changed, 16 insertions, 6 deletions

diff --git a/drivers/media/dvb/dvb-usb/au6610.c b/drivers/media/dvb/dvb-usb/au6610.c
index eb34cc3894e0..2351077ff2b3 100644
--- a/drivers/media/dvb/dvb-usb/au6610.c
+++ b/drivers/media/dvb/dvb-usb/au6610.c
@@ -33,8 +33,16 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
 {
         int ret;
         u16 index;
-        u8 usb_buf[6]; /* enough for all known requests,
-                          read returns 5 and write 6 bytes */
+        u8 *usb_buf;
+
+        /*
+         * allocate enough for all known requests,
+         * read returns 5 and write 6 bytes
+         */
+        usb_buf = kmalloc(6, GFP_KERNEL);
+        if (!usb_buf)
+                return -ENOMEM;
+
         switch (wlen) {
         case 1:
                 index = wbuf[0] << 8;
@@ -45,14 +53,15 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
                 break;
         default:
                 warn("wlen = %x, aborting.", wlen);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto error;
         }
 
         ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), operation,
                               USB_TYPE_VENDOR|USB_DIR_IN, addr << 1, index,
-                              usb_buf, sizeof(usb_buf), AU6610_USB_TIMEOUT);
+                              usb_buf, 6, AU6610_USB_TIMEOUT);
         if (ret < 0)
-                return ret;
+                goto error;
 
         switch (operation) {
         case AU6610_REQ_I2C_READ:
@@ -60,7 +69,8 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
                 /* requested value is always 5th byte in buffer */
                 rbuf[0] = usb_buf[4];
         }
-
+error:
+        kfree(usb_buf);
         return ret;
 }