1 files changed, 22 insertions, 11 deletions

diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index ad63794fda77..6854ac78a161 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -90,17 +90,20 @@ static void uvc_fixup_buffer_size(struct uvc_video_device *video,
 static int uvc_get_video_ctrl(struct uvc_video_device *video,
         struct uvc_streaming_control *ctrl, int probe, __u8 query)
 {
-        __u8 data[34];
-        __u8 size;
+        __u8 *data;
+        __u16 size;
         int ret;
 
         size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
+        data = kmalloc(size, GFP_KERNEL);
+        if (data == NULL)
+                return -ENOMEM;
+
         ret = __uvc_query_ctrl(video->dev, query, 0, video->streaming->intfnum,
-                probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
+                probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, data, size,
                 UVC_CTRL_STREAMING_TIMEOUT);
-
         if (ret < 0)
-                return ret;
+                goto out;
 
         ctrl->bmHint = le16_to_cpup((__le16 *)&data[0]);
         ctrl->bFormatIndex = data[2];
@@ -136,17 +139,22 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
          */
         uvc_fixup_buffer_size(video, ctrl);
 
-        return 0;
+out:
+        kfree(data);
+        return ret;
 }
 
 int uvc_set_video_ctrl(struct uvc_video_device *video,
         struct uvc_streaming_control *ctrl, int probe)
 {
-        __u8 data[34];
-        __u8 size;
+        __u8 *data;
+        __u16 size;
+        int ret;
 
         size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
-        memset(data, 0, sizeof data);
+        data = kzalloc(size, GFP_KERNEL);
+        if (data == NULL)
+                return -ENOMEM;
 
         *(__le16 *)&data[0] = cpu_to_le16(ctrl->bmHint);
         data[2] = ctrl->bFormatIndex;
@@ -174,10 +182,13 @@ int uvc_set_video_ctrl(struct uvc_video_device *video,
                 data[33] = ctrl->bMaxVersion;
         }
 
-        return __uvc_query_ctrl(video->dev, SET_CUR, 0,
+        ret = __uvc_query_ctrl(video->dev, SET_CUR, 0,
                 video->streaming->intfnum,
-                probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
+                probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, data, size,
                 UVC_CTRL_STREAMING_TIMEOUT);
+
+        kfree(data);
+        return ret;
 }
 
 int uvc_probe_video(struct uvc_video_device *video,