Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ea369ee authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'topic/kbuild-fixes-for-next' of... 

Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media build fixes from Mauro Carvalho Chehab:
 "A series of patches that fix compilation on non-x86 archs.

  While most of them are just build fixes, there are some fixes for real
  bugs, as there are a number of drivers using dynamic stack allocation.
  A few of those might be considered a security risk, if the i2c-dev
  module is loaded, as someone could be sending very long I2C data that
  could potentially overflow the Kernel stack.  Ok, as using /dev/i2c-*
  devnodes usually requires root on usual distros, and exploiting it
  would require a DVB board or USB stick, the risk is not high"

* 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits)
  [media] platform drivers: Fix build on frv arch
  [media] lirc_zilog: Don't use dynamic static allocation
  [media] mxl111sf: Don't use dynamic static allocation
  [media] af9035: Don't use dynamic static allocation
  [media] af9015: Don't use dynamic static allocation
  [media] dw2102: Don't use dynamic static allocation
  [media] dibusb-common: Don't use dynamic static allocation
  [media] cxusb: Don't use dynamic static allocation
  [media] v4l2-async: Don't use dynamic static allocation
  [media] cimax2: Don't use dynamic static allocation
  [media] tuner-xc2028: Don't use dynamic static allocation
  [media] tuners: Don't use dynamic static allocation
  [media] av7110_hw: Don't use dynamic static allocation
  [media] stv090x: Don't use dynamic static allocation
  [media] stv0367: Don't use dynamic static allocation
  [media] stb0899_drv: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] dvb-frontends: Don't use dynamic static allocation
  [media] s5h1420: Don't use dynamic static allocation
  [media] uvc/lirc_serial: Fix some warnings on parisc arch
  ...
parents a310410f 3cdcf736

drivers/media/dvb-frontends/af9013.c

+12 −2
Original line number Diff line number Diff line
@@ -24,6 +24,9 @@ 


#include "af9013_priv.h"



/* Max transfer size done by I2C transfer functions */

#define MAX_XFER_SIZE  64



struct af9013_state {

	struct i2c_adapter *i2c;

	struct dvb_frontend fe;
@@ -50,16 +53,23 @@ static int af9013_wr_regs_i2c(struct af9013_state *priv, u8 mbox, u16 reg, 
	const u8 *val, int len)

{

	int ret;

	u8 buf[3+len];

	u8 buf[MAX_XFER_SIZE];

	struct i2c_msg msg[1] = {

		{

			.addr = priv->config.i2c_addr,

			.flags = 0,

			.len = sizeof(buf),

			.len = 3 + len,

			.buf = buf,

		}

	};



	if (3 + len > sizeof(buf)) {

		dev_warn(&priv->i2c->dev,

			 "%s: i2c wr reg=%04x: len=%d is too big!\n",

			 KBUILD_MODNAME, reg, len);

		return -EINVAL;

	}



	buf[0] = (reg >> 8) & 0xff;

	buf[1] = (reg >> 0) & 0xff;

	buf[2] = mbox;

drivers/media/dvb-frontends/af9033.c

+20 −3
Original line number Diff line number Diff line
@@ -21,6 +21,9 @@ 


#include "af9033_priv.h"



/* Max transfer size done by I2C transfer functions */

#define MAX_XFER_SIZE  64



struct af9033_state {

	struct i2c_adapter *i2c;

	struct dvb_frontend fe;
@@ -40,16 +43,23 @@ static int af9033_wr_regs(struct af9033_state *state, u32 reg, const u8 *val, 
		int len)

{

	int ret;

	u8 buf[3 + len];

	u8 buf[MAX_XFER_SIZE];

	struct i2c_msg msg[1] = {

		{

			.addr = state->cfg.i2c_addr,

			.flags = 0,

			.len = sizeof(buf),

			.len = 3 + len,

			.buf = buf,

		}

	};



	if (3 + len > sizeof(buf)) {

		dev_warn(&state->i2c->dev,

			 "%s: i2c wr reg=%04x: len=%d is too big!\n",

			 KBUILD_MODNAME, reg, len);

		return -EINVAL;

	}



	buf[0] = (reg >> 16) & 0xff;

	buf[1] = (reg >>  8) & 0xff;

	buf[2] = (reg >>  0) & 0xff;
@@ -161,7 +171,14 @@ static int af9033_wr_reg_val_tab(struct af9033_state *state, 
		const struct reg_val *tab, int tab_len)

{

	int ret, i, j;

	u8 buf[tab_len];

	u8 buf[MAX_XFER_SIZE];



	if (tab_len > sizeof(buf)) {

		dev_warn(&state->i2c->dev,

			 "%s: i2c wr len=%d is too big!\n",

			 KBUILD_MODNAME, tab_len);

		return -EINVAL;

	}



	dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);

drivers/media/dvb-frontends/bcm3510.c

+14 −1
Original line number Diff line number Diff line
@@ -44,6 +44,9 @@ 
#include "bcm3510.h"

#include "bcm3510_priv.h"



/* Max transfer size done by bcm3510_do_hab_cmd() function */

#define MAX_XFER_SIZE	128



struct bcm3510_state {



	struct i2c_adapter* i2c;
@@ -201,9 +204,19 @@ static int bcm3510_hab_send_request(struct bcm3510_state *st, u8 *buf, int len) 


static int bcm3510_do_hab_cmd(struct bcm3510_state *st, u8 cmd, u8 msgid, u8 *obuf, u8 olen, u8 *ibuf, u8 ilen)

{

	u8 ob[olen+2],ib[ilen+2];

	u8 ob[MAX_XFER_SIZE], ib[MAX_XFER_SIZE];

	int ret = 0;



	if (ilen + 2 > sizeof(ib)) {

		deb_hab("do_hab_cmd: ilen=%d is too big!\n", ilen);

		return -EINVAL;

	}



	if (olen + 2 > sizeof(ob)) {

		deb_hab("do_hab_cmd: olen=%d is too big!\n", olen);

		return -EINVAL;

	}



	ob[0] = cmd;

	ob[1] = msgid;

	memcpy(&ob[2],obuf,olen);

drivers/media/dvb-frontends/cxd2820r_core.c

+19 −2
Original line number Diff line number Diff line
@@ -21,12 +21,15 @@ 


#include "cxd2820r_priv.h"



/* Max transfer size done by I2C transfer functions */

#define MAX_XFER_SIZE  64



/* write multiple registers */

static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg,

	u8 *val, int len)

{

	int ret;

	u8 buf[len+1];

	u8 buf[MAX_XFER_SIZE];

	struct i2c_msg msg[1] = {

		{

			.addr = i2c,
@@ -36,6 +39,13 @@ static int cxd2820r_wr_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg, 
		}

	};



	if (1 + len > sizeof(buf)) {

		dev_warn(&priv->i2c->dev,

			 "%s: i2c wr reg=%04x: len=%d is too big!\n",

			 KBUILD_MODNAME, reg, len);

		return -EINVAL;

	}



	buf[0] = reg;

	memcpy(&buf[1], val, len);
@@ -55,7 +65,7 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg, 
	u8 *val, int len)

{

	int ret;

	u8 buf[len];

	u8 buf[MAX_XFER_SIZE];

	struct i2c_msg msg[2] = {

		{

			.addr = i2c,
@@ -70,6 +80,13 @@ static int cxd2820r_rd_regs_i2c(struct cxd2820r_priv *priv, u8 i2c, u8 reg, 
		}

	};



	if (len > sizeof(buf)) {

		dev_warn(&priv->i2c->dev,

			 "%s: i2c wr reg=%04x: len=%d is too big!\n",

			 KBUILD_MODNAME, reg, len);

		return -EINVAL;

	}



	ret = i2c_transfer(priv->i2c, msg, 2);

	if (ret == 2) {

		memcpy(val, buf, len);

drivers/media/dvb-frontends/itd1000.c

+12 −1
Original line number Diff line number Diff line
@@ -31,6 +31,9 @@ 
#include "itd1000.h"

#include "itd1000_priv.h"



/* Max transfer size done by I2C transfer functions */

#define MAX_XFER_SIZE  64



static int debug;

module_param(debug, int, 0644);

MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
@@ -52,10 +55,18 @@ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off)."); 
/* don't write more than one byte with flexcop behind */

static int itd1000_write_regs(struct itd1000_state *state, u8 reg, u8 v[], u8 len)

{

	u8 buf[1+len];

	u8 buf[MAX_XFER_SIZE];

	struct i2c_msg msg = {

		.addr = state->cfg->i2c_address, .flags = 0, .buf = buf, .len = len+1

	};



	if (1 + len > sizeof(buf)) {

		printk(KERN_WARNING

		       "itd1000: i2c wr reg=%04x: len=%d is too big!\n",

		       reg, len);

		return -EINVAL;

	}



	buf[0] = reg;

	memcpy(&buf[1], v, len);