upstream: [media] m88ts2022: do not use dynamic stack allocation

I2C transfer were using dynamic stack allocation. Get rid of it.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/drivers/media/tuners/m88ts2022.c b/drivers/media/tuners/m88ts2022.c
index d78fa90..8e7a35d 100644 (file)
--- a/drivers/media/tuners/m88ts2022.c
+++ b/drivers/media/tuners/m88ts2022.c
@@ -22,17 +22,22 @@
 static int m88ts2022_wr_regs(struct m88ts2022_priv *priv,
                u8 reg, const u8 *val, int len)
 {
+#define MAX_WR_LEN 3
+#define MAX_WR_XFER_LEN (MAX_WR_LEN + 1)
        int ret;
-       u8 buf[1 + len];
+       u8 buf[MAX_WR_XFER_LEN];
        struct i2c_msg msg[1] = {
                {
                        .addr = priv->cfg->i2c_addr,
                        .flags = 0,
-                       .len = sizeof(buf),
+                       .len = 1 + len,
                        .buf = buf,
                }
        };
 
+       if (WARN_ON(len > MAX_WR_LEN))
+               return -EINVAL;
+
        buf[0] = reg;
        memcpy(&buf[1], val, len);
 
@@ -53,8 +58,10 @@ static int m88ts2022_wr_regs(struct m88ts2022_priv *priv,
 static int m88ts2022_rd_regs(struct m88ts2022_priv *priv, u8 reg,
                u8 *val, int len)
 {
+#define MAX_RD_LEN 1
+#define MAX_RD_XFER_LEN (MAX_RD_LEN)
        int ret;
-       u8 buf[len];
+       u8 buf[MAX_RD_XFER_LEN];
        struct i2c_msg msg[2] = {
                {
                        .addr = priv->cfg->i2c_addr,
@@ -64,11 +71,14 @@ static int m88ts2022_rd_regs(struct m88ts2022_priv *priv, u8 reg,
                }, {
                        .addr = priv->cfg->i2c_addr,
                        .flags = I2C_M_RD,
-                       .len = sizeof(buf),
+                       .len = len,
                        .buf = buf,
                }
        };
 
+       if (WARN_ON(len > MAX_RD_LEN))
+               return -EINVAL;
+
        ret = i2c_transfer(priv->i2c, msg, 2);
        if (ret == 2) {
                memcpy(val, buf, len);