|
@@ -35,6 +35,9 @@
|
|
|
#include "stv090x.h"
|
|
|
#include "stv090x_priv.h"
|
|
|
|
|
|
+/* Max transfer size done by I2C transfer functions */
|
|
|
+#define MAX_XFER_SIZE 64
|
|
|
+
|
|
|
static unsigned int verbose;
|
|
|
module_param(verbose, int, 0644);
|
|
|
|
|
@@ -722,9 +725,16 @@ static int stv090x_write_regs(struct stv090x_state *state, unsigned int reg, u8
|
|
|
{
|
|
|
const struct stv090x_config *config = state->config;
|
|
|
int ret;
|
|
|
- u8 buf[2 + count];
|
|
|
+ u8 buf[MAX_XFER_SIZE];
|
|
|
struct i2c_msg i2c_msg = { .addr = config->address, .flags = 0, .buf = buf, .len = 2 + count };
|
|
|
|
|
|
+ if (2 + count > sizeof(buf)) {
|
|
|
+ printk(KERN_WARNING
|
|
|
+ "%s: i2c wr reg=%04x: len=%d is too big!\n",
|
|
|
+ KBUILD_MODNAME, reg, count);
|
|
|
+ return -EINVAL;
|
|
|
+ }
|
|
|
+
|
|
|
buf[0] = reg >> 8;
|
|
|
buf[1] = reg & 0xff;
|
|
|
memcpy(&buf[2], data, count);
|