[lkml]   [2013]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 3.12 198/212] media: tuner-xc2028: Dont use dynamic static allocation
    3.12-stable review patch.  If anyone has any objections, please let me know.


    From: Mauro Carvalho Chehab <>

    commit 56ac033725ec93a45170caf3979eb2b1211a59a8 upstream.

    Dynamic static allocation is evil, as Kernel stack is too low, and
    compilation complains about it on some archs:
    drivers/media/tuners/tuner-xc2028.c:651:1: warning: 'load_firmware' uses dynamic stack allocation [enabled by default]
    Instead, let's enforce a limit for the buffer.
    In the specific case of this driver, the maximum limit is 80, used only
    on tm6000 driver. This limit is due to the size of the USB control URBs.
    Ok, it would be theoretically possible to use a bigger size on PCI
    devices, but the firmware load time is already good enough. Anyway,
    if some usage requires more, it is just a matter of also increasing
    the buffer size at load_firmware().

    Signed-off-by: Mauro Carvalho Chehab <>
    Reviewed-by: Hans Verkuil <>
    Signed-off-by: Mauro Carvalho Chehab <>
    Signed-off-by: Greg Kroah-Hartman <>

    drivers/media/tuners/tuner-xc2028.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/drivers/media/tuners/tuner-xc2028.c
    +++ b/drivers/media/tuners/tuner-xc2028.c
    @@ -24,6 +24,9 @@
    #include <linux/dvb/frontend.h>
    #include "dvb_frontend.h"

    +/* Max transfer size done by I2C transfer functions */
    +#define MAX_XFER_SIZE 80
    /* Registers (Write-only) */
    #define XREG_INIT 0x00
    #define XREG_RF_FREQ 0x02
    @@ -547,7 +550,10 @@ static int load_firmware(struct dvb_fron
    struct xc2028_data *priv = fe->tuner_priv;
    int pos, rc;
    - unsigned char *p, *endp, buf[priv->ctrl.max_len];
    + unsigned char *p, *endp, buf[MAX_XFER_SIZE];
    + if (priv->ctrl.max_len > sizeof(buf))
    + priv->ctrl.max_len = sizeof(buf);

    tuner_dbg("%s called\n", __func__);

     \ /
      Last update: 2013-12-02 21:41    [W:6.319 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site