From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Date: Tue, 11 Aug 2015 18:29:54 +0000 (-0300)
Subject: [media] horus3a: don't use variable length arrays
X-Git-Tag: Ubuntu-snapdragon-4.4.0-1029.32~5902^2~35
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=4aabd91625d0887210f68382f3fccb29a4586792;p=mirror_ubuntu-zesty-kernel.git

[media] horus3a: don't use variable length arrays

The Linux stack is short; we need to be able to count the number
of bytes used at stack on each function. So, we don't like to
use variable-length arrays, as complained by smatch:
	drivers/media/dvb-frontends/horus3a.c:57:19: warning: Variable length array is used.

The max usecase of the driver seems to be 5 bytes + 1 for the
register.

So, let's be safe and allocate 6 bytes for the write buffer.
This should be enough to cover all cases. If not, let's print
an error message.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
---

diff --git a/drivers/media/dvb-frontends/horus3a.c b/drivers/media/dvb-frontends/horus3a.c
index 46a82dc586d8..5074305b289e 100644
--- a/drivers/media/dvb-frontends/horus3a.c
+++ b/drivers/media/dvb-frontends/horus3a.c
@@ -26,6 +26,8 @@
 #include "horus3a.h"
 #include "dvb_frontend.h"
 
+#define MAX_WRITE_REGSIZE      5
+
 enum horus3a_state {
 	STATE_UNKNOWN,
 	STATE_SLEEP,
@@ -54,16 +56,22 @@ static int horus3a_write_regs(struct horus3a_priv *priv,
 			      u8 reg, const u8 *data, u32 len)
 {
 	int ret;
-	u8 buf[len+1];
+	u8 buf[MAX_WRITE_REGSIZE + 1];
 	struct i2c_msg msg[1] = {
 		{
 			.addr = priv->i2c_address,
 			.flags = 0,
-			.len = sizeof(buf),
+			.len = len + 1,
 			.buf = buf,
 		}
 	};
 
+	if (len + 1 >= sizeof(buf)) {
+		dev_warn(&priv->i2c->dev,"wr reg=%04x: len=%d is too big!\n",
+			 reg, len + 1);
+		return -E2BIG;
+	}
+
 	horus3a_i2c_debug(priv, reg, 1, data, len);
 	buf[0] = reg;
 	memcpy(&buf[1], data, len);