Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

[media] cxd2841er: don't use variable length arrays

The Linux stack is short; we need to be able to count the number
of bytes used at stack on each function. So, we don't like to
use variable-length arrays, as complained by smatch:

drivers/media/dvb-frontends/cxd2841er.c:205:19: warning: Variable length array is used.

The max usecase of the driver seems to be 15 bytes + 1 for the
register.

So, let's be safe and allocate 17 bytes for the write buffer.
This should be enough to cover all cases. If not, let's print
an error message.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

+10 -2
+10 -2
drivers/media/dvb-frontends/cxd2841er.c
··· 33 33 #include "cxd2841er.h" 34 34 #include "cxd2841er_priv.h" 35 35 36 + #define MAX_WRITE_REGSIZE 16 37 + 36 38 enum cxd2841er_state { 37 39 STATE_SHUTDOWN = 0, 38 40 STATE_SLEEP_S, ··· 204 202 u8 addr, u8 reg, const u8 *data, u32 len) 205 203 { 206 204 int ret; 207 - u8 buf[len+1]; 205 + u8 buf[MAX_WRITE_REGSIZE + 1]; 208 206 u8 i2c_addr = (addr == I2C_SLVX ? 209 207 priv->i2c_addr_slvx : priv->i2c_addr_slvt); 210 208 struct i2c_msg msg[1] = { 211 209 { 212 210 .addr = i2c_addr, 213 211 .flags = 0, 214 - .len = sizeof(buf), 212 + .len = len + 1, 215 213 .buf = buf, 216 214 } 217 215 }; 216 + 217 + if (len + 1 >= sizeof(buf)) { 218 + dev_warn(&priv->i2c->dev,"wr reg=%04x: len=%d is too big!\n", 219 + reg, len + 1); 220 + return -E2BIG; 221 + } 218 222 219 223 cxd2841er_i2c_debug(priv, i2c_addr, reg, 1, data, len); 220 224 buf[0] = reg;