2 files changed, 16 insertions, 17 deletions

diff --git a/drivers/media/video/hdpvr/hdpvr-i2c.c b/drivers/media/video/hdpvr/hdpvr-i2c.c
index 45b88cf60d68..89b71faeaac2 100644
--- a/drivers/media/video/hdpvr/hdpvr-i2c.c
+++ b/drivers/media/video/hdpvr/hdpvr-i2c.c
@@ -57,23 +57,21 @@ static int hdpvr_i2c_read(struct hdpvr_device *dev, int bus,
                           unsigned char addr, char *data, int len)
 {
         int ret;
-        char *buf = kmalloc(len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
+
+        if (len > sizeof(dev->i2c_buf))
+                return -EINVAL;
 
         ret = usb_control_msg(dev->udev,
                               usb_rcvctrlpipe(dev->udev, 0),
                               REQTYPE_I2C_READ, CTRL_READ_REQUEST,
-                              (bus << 8) | addr, 0, buf, len, 1000);
+                              (bus << 8) | addr, 0, &dev->i2c_buf, len, 1000);
 
         if (ret == len) {
-                memcpy(data, buf, len);
+                memcpy(data, &dev->i2c_buf, len);
                 ret = 0;
         } else if (ret >= 0)
                 ret = -EIO;
 
-        kfree(buf);
-
         return ret;
 }
 
@@ -81,31 +79,29 @@ static int hdpvr_i2c_write(struct hdpvr_device *dev, int bus,
                            unsigned char addr, char *data, int len)
 {
         int ret;
-        char *buf = kmalloc(len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
 
-        memcpy(buf, data, len);
+        if (len > sizeof(dev->i2c_buf))
+                return -EINVAL;
+
+        memcpy(&dev->i2c_buf, data, len);
         ret = usb_control_msg(dev->udev,
                               usb_sndctrlpipe(dev->udev, 0),
                               REQTYPE_I2C_WRITE, CTRL_WRITE_REQUEST,
-                              (bus << 8) | addr, 0, buf, len, 1000);
+                              (bus << 8) | addr, 0, &dev->i2c_buf, len, 1000);
 
         if (ret < 0)
-                goto error;
+                return ret;
 
         ret = usb_control_msg(dev->udev,
                               usb_rcvctrlpipe(dev->udev, 0),
                               REQTYPE_I2C_WRITE_STATT, CTRL_READ_REQUEST,
-                              0, 0, buf, 2, 1000);
+                              0, 0, &dev->i2c_buf, 2, 1000);
 
-        if ((ret == 2) && (buf[1] == (len - 1)))
+        if ((ret == 2) && (dev->i2c_buf[1] == (len - 1)))
                 ret = 0;
         else if (ret >= 0)
                 ret = -EIO;
 
-error:
-        kfree(buf);
         return ret;
 }
 
diff --git a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
index 29f74269400c..ee74e3be9a6a 100644
--- a/drivers/media/video/hdpvr/hdpvr.h
+++ b/drivers/media/video/hdpvr/hdpvr.h
@@ -25,6 +25,7 @@
         KERNEL_VERSION(HDPVR_MAJOR_VERSION, HDPVR_MINOR_VERSION, HDPVR_RELEASE)
 
 #define HDPVR_MAX 8
+#define HDPVR_I2C_MAX_SIZE 128
 
 /* Define these values to match your devices */
 #define HD_PVR_VENDOR_ID        0x2040
@@ -109,6 +110,8 @@ struct hdpvr_device {
         struct i2c_adapter      i2c_adapter;
         /* I2C lock */
         struct mutex            i2c_mutex;
+        /* I2C message buffer space */
+        char                    i2c_buf[HDPVR_I2C_MAX_SIZE];
 
         /* For passing data to ir-kbd-i2c */
         struct IR_i2c_init_data ir_i2c_init_data;