From: Saso Slavicic Date: Wed, 13 Jul 2016 14:56:22 +0000 (-0300) Subject: [media] ascot2e: Fix I2C message size check X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=cd82982179cecc1832ae83ef3cc6ba5100fe964d;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git [media] ascot2e: Fix I2C message size check Tuning a card with Sony ASCOT2E produces the following error: kernel: i2c i2c-9: wr reg=0006: len=11 is too big! MAX_WRITE_REGSIZE is defined as 10, buf[MAX_WRITE_REGSIZE + 1] buffer is used in ascot2e_write_regs(). The problem is that exactly 10 bytes are written in ascot2e_set_params(): /* Set BW_OFFSET (0x0F) value from parameter table */ data[9] = ascot2e_sett[tv_system].bw_offset; ascot2e_write_regs(priv, 0x06, data, 10); The test in write_regs is as follows: if (len + 1 >= sizeof(buf)) 10 + 1 = 11 and that would be exactly the size of buf. Since 10 bytes + buf[0] = reg would seem to fit into buf[], this shouldn't be an error. Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/dvb-frontends/ascot2e.c b/drivers/media/dvb-frontends/ascot2e.c index f770f6a2c987..8cc8c4597b6a 100644 --- a/drivers/media/dvb-frontends/ascot2e.c +++ b/drivers/media/dvb-frontends/ascot2e.c @@ -132,7 +132,7 @@ static int ascot2e_write_regs(struct ascot2e_priv *priv, } }; - if (len + 1 >= sizeof(buf)) { + if (len + 1 > sizeof(buf)) { dev_warn(&priv->i2c->dev,"wr reg=%04x: len=%d is too big!\n", reg, len + 1); return -E2BIG;