diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-11-18 15:10:05 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-11-18 15:10:05 -0800 |
| commit | 3ea369eea07eb64adf36a6fb7fddb5d082c84143 (patch) | |
| tree | 976e44b7baf67bc1f9837ebed447e4b686ad4187 /drivers/media/dvb-frontends/rtl2832.c | |
| parent | a310410f616c78f24490de1274487a7b7b137d97 (diff) | |
| parent | 3cdcf7369cdb3406c61090e453b78cb8d4882ef8 (diff) | |
| download | op-kernel-dev-3ea369eea07eb64adf36a6fb7fddb5d082c84143.zip op-kernel-dev-3ea369eea07eb64adf36a6fb7fddb5d082c84143.tar.gz | |
Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media build fixes from Mauro Carvalho Chehab:
"A series of patches that fix compilation on non-x86 archs.
While most of them are just build fixes, there are some fixes for real
bugs, as there are a number of drivers using dynamic stack allocation.
A few of those might be considered a security risk, if the i2c-dev
module is loaded, as someone could be sending very long I2C data that
could potentially overflow the Kernel stack. Ok, as using /dev/i2c-*
devnodes usually requires root on usual distros, and exploiting it
would require a DVB board or USB stick, the risk is not high"
* 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits)
[media] platform drivers: Fix build on frv arch
[media] lirc_zilog: Don't use dynamic static allocation
[media] mxl111sf: Don't use dynamic static allocation
[media] af9035: Don't use dynamic static allocation
[media] af9015: Don't use dynamic static allocation
[media] dw2102: Don't use dynamic static allocation
[media] dibusb-common: Don't use dynamic static allocation
[media] cxusb: Don't use dynamic static allocation
[media] v4l2-async: Don't use dynamic static allocation
[media] cimax2: Don't use dynamic static allocation
[media] tuner-xc2028: Don't use dynamic static allocation
[media] tuners: Don't use dynamic static allocation
[media] av7110_hw: Don't use dynamic static allocation
[media] stv090x: Don't use dynamic static allocation
[media] stv0367: Don't use dynamic static allocation
[media] stb0899_drv: Don't use dynamic static allocation
[media] dvb-frontends: Don't use dynamic static allocation
[media] dvb-frontends: Don't use dynamic static allocation
[media] s5h1420: Don't use dynamic static allocation
[media] uvc/lirc_serial: Fix some warnings on parisc arch
...
Diffstat (limited to 'drivers/media/dvb-frontends/rtl2832.c')
| -rw-r--r-- | drivers/media/dvb-frontends/rtl2832.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c index a95dfe0..ff73da9 100644 --- a/drivers/media/dvb-frontends/rtl2832.c +++ b/drivers/media/dvb-frontends/rtl2832.c @@ -22,6 +22,9 @@ #include "dvb_math.h" #include <linux/bitops.h> +/* Max transfer size done by I2C transfer functions */ +#define MAX_XFER_SIZE 64 + int rtl2832_debug; module_param_named(debug, rtl2832_debug, int, 0644); MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off)."); @@ -162,16 +165,23 @@ static const struct rtl2832_reg_entry registers[] = { static int rtl2832_wr(struct rtl2832_priv *priv, u8 reg, u8 *val, int len) { int ret; - u8 buf[1+len]; + u8 buf[MAX_XFER_SIZE]; struct i2c_msg msg[1] = { { .addr = priv->cfg.i2c_addr, .flags = 0, - .len = 1+len, + .len = 1 + len, .buf = buf, } }; + if (1 + len > sizeof(buf)) { + dev_warn(&priv->i2c->dev, + "%s: i2c wr reg=%04x: len=%d is too big!\n", + KBUILD_MODNAME, reg, len); + return -EINVAL; + } + buf[0] = reg; memcpy(&buf[1], val, len); |
